Date:	Sat, 20 Feb 1999 21:20:13 -0800
From:	Shane Wegner <shane@CM.NU>
Subject:      Possible DOS attack in the .nu domain service
To:	BUGTRAQ@NETSPACE.ORG

--9jxsPFA5p3P2qPhR
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Hello all,

I am not sure if this is known or even relevant to the list and if not,
please excuse this post.

There appears to be a bug in the niu DNS setup process which could result
in a DOS attack for those using their domains.  For those unfamiliar with
niu, they provide sub-domain service under the .nu domain to machines
which do there own DNS.  I have written to them on several occasions about
this issue but as of yet have received no response.

OK the bug is that any user who is willing to pay the $25 to register a
=2Enu domain can knock out or redirect a host under another.  This is best
shown through an example.

I register mycompany.nu and in the registration form enter the hosts I
have doing the DNS for it.

Name: mycompany.nu
DNS1: machine.someserver.com
DNS2: machine2.someserver.com

After this step, my DNS entry in the .nu table looks like this

$ORIGIN nu.
mycompany	IN	NS	machine2.someserver.com.
		IN	NS	machine2.someserver.com.

mycompany.nu for the sake of this example had the following DNS table.

$ORIGIN nu.
mycompany	IN	SOA	mymachine.mycompany.nu. hostmaster.mycompany.nu. (
		1 301 120 604800 600 )
		IN	NS	machine1.someserver.com.=20
		IN	NS	machine2.someserver.com.
$ORIGIN	 mycompany.nu.
mymachine	IN	A	192.168.1.1

So Al's well until someone registers evil.nu with the goal of knocking out
myserver.mycompany.nu.  On the form, they enter the following.

name: evil.nu
DNS1: mymachine.mycompany.nu
DNS1IP: 127.0.0.1

Now here's the bug, if you enter an IP for a machine which falls under the
=2Enu name-space, it maps it statically.  It does not check to see if it
falls under your name-space.  Therefore, our evil.nu entry in the .nu
table looks like this.

$ORIGIN nu.
evil		IN	NS	mymachine.mycompany.nu.
$ORIGIN mycompany.nu.
mymachine	IN	A	127.0.0.1

So the IP for mymachine.mycompany.nu has been redirected from its
192.168.1.1 to 127.0.0.1.  An attacker could conceivably redirect the mail
servers of a company to his own machine or anything to that effect.

Regards,
Shane

--=20
Shane Wegner: shane@cm.nu
Tel: (604) 930-0530
Sysadmin, Continuum Systems: http://www.cm.nu
Personal website: http://www.cm.nu/~shane
ICQ UIN: 120000
PGP: keyid:       2048/F5C2BD91
     Fingerprint: 8C 48 B9 D8 53 BB D8 EF
                  76 BB DB A2 1C 0D 1D 87

--9jxsPFA5p3P2qPhR
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v0.9.2 (GNU/Linux)
Comment: md5

iQEVAwUBNs+Xi3ernFT1wr2RAQH7xggAhLlJ/7tTDDXkjidueiZSdVeomKZtn8Rb
xNN49WcucAD9HUQw99ON654rABeKgPtx7lV/4MRjmZ6AhHd43Ho/Vloql/c841IO
YeH1qgX1J55Qahi786fLoz5h/bA4HN6CUyG4viqfe4uyQ9VkggYgd5Tg6+9dD6+a
T5IVpu2sTU6G8lJb7QEco3ir3W1o/6FYrr2PK+oXLoIVnT7qHb2/ErEstQ9zMP6k
zhhGnRAmp7L/FLvpmpER9yCrY7z8h4K2kM1e+J5bYJXaS5PoZTgrE6wqVGdiHNpc
EzMpob4HO/jSbkvq8kHiJB2V6PHthhBpMDb7Ws2OEYPErGAGMb0ZyA==
=i/XG
-----END PGP SIGNATURE-----

--9jxsPFA5p3P2qPhR--