- NANOG - lists.nanog.org

Re: News of ISC Developing BIND Patch
by Paul Vixie 17 Sep '03

17 Sep '03

> I trust your assessment of the DNS techs. But what about [their] bosses? the ones i've met in recent years seemed like reasonable people. > They ordered some pretty lumpy things be done with .com and .net. > Given that track record, whats to stop them from ordering [the techs] > from doing something equally lumpy. root zone content is tied up in all kinds of red tape. the root server operators won't modify it in any way; we publish only what we get from iana. iana and verisign and the united states department of commerce all have to agree on changes to it. imagine a "mexican standoff" with three people and six guns. with the ietf/iab as referee and scorekeeper, and the rootops as an interested audience. ("entertain me!") i'll say it again. nothing that happens in dot-com or dot-net has any relevance at all to the root zone, or to the root server operators.

1 0

Heads up -- potential problems in 3.7, too? [Fwd: OpenSSH Security Advisory: buffer.adv]
by Alex Lambert 17 Sep '03

17 Sep '03

3.7.1 was just released. Two patches for similar issues in a very short timeframe. Who do they think they are -- Microsoft? <grin> apl -------- Original Message -------- Subject: OpenSSH Security Advisory: buffer.adv Date: Wed, 17 Sep 2003 01:13:30 +0200 From: Markus Friedl <markus(a)openbsd.org> To: misc(a)openbsd.org This is the 2nd revision of the Advisory. This document can be found at: http://www.openssh.com/txt/buffer.adv 1. Versions affected: All versions of OpenSSH's sshd prior to 3.7.1 contain buffer management errors. It is uncertain whether these errors are potentially exploitable, however, we prefer to see bugs fixed proactively. Other implementations sharing common origin may also have these issues. 2. Solution: Upgrade to OpenSSH 3.7.1 or apply the following patch. =================================================================== Appendix A: patch for OpenSSH 3.6.1 and earlier Index: buffer.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/buffer.c,v retrieving revision 1.16 retrieving revision 1.18 diff -u -r1.16 -r1.18 --- buffer.c 26 Jun 2002 08:54:18 -0000 1.16 +++ buffer.c 16 Sep 2003 21:02:39 -0000 1.18 @@ -23,8 +23,11 @@ void buffer_init(Buffer *buffer) { - buffer->alloc = 4096; - buffer->buf = xmalloc(buffer->alloc); + const u_int len = 4096; + + buffer->alloc = 0; + buffer->buf = xmalloc(len); + buffer->alloc = len; buffer->offset = 0; buffer->end = 0; } @@ -34,8 +37,10 @@ void buffer_free(Buffer *buffer) { - memset(buffer->buf, 0, buffer->alloc); - xfree(buffer->buf); + if (buffer->alloc > 0) { + memset(buffer->buf, 0, buffer->alloc); + xfree(buffer->buf); + } } /* @@ -69,6 +74,7 @@ void * buffer_append_space(Buffer *buffer, u_int len) { + u_int newlen; void *p; if (len > 0x100000) @@ -98,11 +104,13 @@ goto restart; } /* Increase the size of the buffer and retry. */ - buffer->alloc += len + 32768; - if (buffer->alloc > 0xa00000) + + newlen = buffer->alloc + len + 32768; + if (newlen > 0xa00000) fatal("buffer_append_space: alloc %u not supported", - buffer->alloc); - buffer->buf = xrealloc(buffer->buf, buffer->alloc); + newlen); + buffer->buf = xrealloc(buffer->buf, newlen); + buffer->alloc = newlen; goto restart; /* NOTREACHED */ } Index: channels.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/channels.c,v retrieving revision 1.194 retrieving revision 1.195 diff -u -r1.194 -r1.195 --- channels.c 29 Aug 2003 10:04:36 -0000 1.194 +++ channels.c 16 Sep 2003 21:02:40 -0000 1.195 @@ -228,12 +228,13 @@ if (found == -1) { /* There are no free slots. Take last+1 slot and expand the array. */ found = channels_alloc; - channels_alloc += 10; if (channels_alloc > 10000) fatal("channel_new: internal error: channels_alloc %d " "too big.", channels_alloc); + channels = xrealloc(channels, + (channels_alloc + 10) * sizeof(Channel *)); + channels_alloc += 10; debug2("channel: expanding %d", channels_alloc); - channels = xrealloc(channels, channels_alloc * sizeof(Channel *)); for (i = found; i < channels_alloc; i++) channels[i] = NULL; } =================================================================== Appendix B: patch for OpenSSH 3.7 Index: buffer.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/buffer.c,v retrieving revision 1.17 retrieving revision 1.18 diff -u -r1.17 -r1.18 --- buffer.c 16 Sep 2003 03:03:47 -0000 1.17 +++ buffer.c 16 Sep 2003 21:02:39 -0000 1.18 @@ -23,8 +23,11 @@ void buffer_init(Buffer *buffer) { - buffer->alloc = 4096; - buffer->buf = xmalloc(buffer->alloc); + const u_int len = 4096; + + buffer->alloc = 0; + buffer->buf = xmalloc(len); + buffer->alloc = len; buffer->offset = 0; buffer->end = 0; } @@ -34,8 +37,10 @@ void buffer_free(Buffer *buffer) { - memset(buffer->buf, 0, buffer->alloc); - xfree(buffer->buf); + if (buffer->alloc > 0) { + memset(buffer->buf, 0, buffer->alloc); + xfree(buffer->buf); + } } /* Index: channels.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/channels.c,v retrieving revision 1.194 retrieving revision 1.195 diff -u -r1.194 -r1.195 --- channels.c 29 Aug 2003 10:04:36 -0000 1.194 +++ channels.c 16 Sep 2003 21:02:40 -0000 1.195 @@ -228,12 +228,13 @@ if (found == -1) { /* There are no free slots. Take last+1 slot and expand the array. */ found = channels_alloc; - channels_alloc += 10; if (channels_alloc > 10000) fatal("channel_new: internal error: channels_alloc %d " "too big.", channels_alloc); + channels = xrealloc(channels, + (channels_alloc + 10) * sizeof(Channel *)); + channels_alloc += 10; debug2("channel: expanding %d", channels_alloc); - channels = xrealloc(channels, channels_alloc * sizeof(Channel *)); for (i = found; i < channels_alloc; i++) channels[i] = NULL; } ===================================================================

6 6

NANOG29 Topics
by Susan Harris 17 Sep '03

17 Sep '03

Greetings - here are the topics we've lined up so far for NANOG29 (Chicago, Oct. 19-21, our 2nd joint meeting with ARIN.) Stay tuned, we're still adding new talks: http://www.nanog.org/mtg-0310/topics.html Sunday Tutorials ---------------- - "Implementing a Secure Network Infrastructure" Level: Introductory (Merike Kaeo) - "Deploying IP Anycast" Level: Introductory (Kevin Miller, CMU) - "BGP Troubleshooting Techniques" Level: Introductory/Intermediate (Philip Smith, Cisco) - "MPLS Applications Overview" Level: Introductory (Ina Minei, Juniper) General Session (Monday - Tuesday) --------------------------------- - Panel: "Watching Your Router Configurations and Detecting Those Exciting Little Changes" Randy Bush, IIJ, moderator; Henry Kilmer, Terrapin Communications; John Heasley, Verio - BGP: Good MEDs Gone Bad! Danny McPherson, Arbor - Panel: "Simple Router Security, What Every ISP Router Engineer Should Know and Practice" Randy Bush, IIJ, moderator; George Jones, MITRE; Rob Thomas, Cisco/Team Cymru - "A Systematic Approach to BGP Configuration Checking" Nick Feamster and Hari Balakrishnan, MIT - "Update on Anomalous DNS Behavior" Duane Wessels, Packet Pushers - "Flawed Routers Flood University of Wisconsin Internet Time Server" Dave Plonka, University of Wisconsin - Madison - "The Blaster Worm: The View From 10,000 Feet" Jose Nazario, Arbor - "GBIC Interface Standards Support in the Telecommunications Industry" Dave Wodelet, Shaw Communications - "An Overview of the Global IPv6 Routing Table" Cathy Wittbrodt Research Forum -------------- - "Passive Internet Health Monitoring With BGP" Kenneth McGrath, Dartmouth - "AutoFocus: A Tool for Automatic Traffic Analysis" Cristian Estan, UCSD - "How to Compute Accurate Traffic Matrices for Your Network in Seconds" Yin Zhang, Matthew Roughan, Albert Greenberg, David Donoho, Nick Duffield, and Carsten Lund, AT&T Monday Evening BOFs ------------------- - ISP Security BOF IV Barry Raveendran Greene, Cisco, moderator

1 0

RE: Delivery Status Notification (Failure)
by Mike Damm 16 Sep '03

16 Sep '03

Who's up for null routing all of Merrill Lynch? (See VeriSign thread to find humor) On a serious note, anyone have any contacts there? --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Haesu [mailto:haesu@towardex.com] Sent: Tuesday, September 16, 2003 4:05 PM To: Michel Py; nanog(a)merit.edu Subject: Re: Delivery Status Notification (Failure) I'm seeing the same... -hc -- Sincerely, Haesu C. TowardEX Technologies, Inc. WWW: http://www.towardex.com E-mail: haesu(a)towardex.com Cell: (978) 394-2867 On Tue, Sep 16, 2003 at 03:51:00PM -0700, Michel Py wrote: > > Mee too. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Mike Damm > Sent: Tuesday, September 16, 2003 3:17 PM > To: nanog(a)merit.edu > Subject: FW: Delivery Status Notification (Failure) > > > Is anyone else seeing a sort of mail loop issue at ml.com? > I'm getting odd bounces to list postings as well as a few duplicates of > list > mail. > > -Mike > > --- > Michael Damm, MIS Department, Irwin Research & Development > V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com > > > -----Original Message----- > From: postmaster(a)win.ml.com [mailto:postmaster@win.ml.com] > Sent: Tuesday, September 16, 2003 2:46 PM > To: MikeD(a)irwinresearch.com > Subject: Delivery Status Notification (Failure) > > This is an automatically generated Delivery Status Notification. > > Unable to deliver message to the following recipients, because the > message > was forwarded more than the maximum allowed times. This could indicate a > mail loop. > > nanog(a)merit.edu > MikeD(a)irwinresearch.com > ahu(a)ds9a.nl > > >

1 0

RE: Delivery Status Notification (Failure)
by Michel Py 16 Sep '03

16 Sep '03

Mee too. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Damm Sent: Tuesday, September 16, 2003 3:17 PM To: nanog(a)merit.edu Subject: FW: Delivery Status Notification (Failure) Is anyone else seeing a sort of mail loop issue at ml.com? I'm getting odd bounces to list postings as well as a few duplicates of list mail. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: postmaster(a)win.ml.com [mailto:postmaster@win.ml.com] Sent: Tuesday, September 16, 2003 2:46 PM To: MikeD(a)irwinresearch.com Subject: Delivery Status Notification (Failure) This is an automatically generated Delivery Status Notification. Unable to deliver message to the following recipients, because the message was forwarded more than the maximum allowed times. This could indicate a mail loop. nanog(a)merit.edu MikeD(a)irwinresearch.com ahu(a)ds9a.nl

2 1

FW: Delivery Status Notification (Failure)
by Mike Damm 16 Sep '03

16 Sep '03

Is anyone else seeing a sort of mail loop issue at ml.com? I'm getting odd bounces to list postings as well as a few duplicates of list mail. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: postmaster(a)win.ml.com [mailto:postmaster@win.ml.com] Sent: Tuesday, September 16, 2003 2:46 PM To: MikeD(a)irwinresearch.com Subject: Delivery Status Notification (Failure) This is an automatically generated Delivery Status Notification. Unable to deliver message to the following recipients, because the message was forwarded more than the maximum allowed times. This could indicate a mail loop. nanog(a)merit.edu MikeD(a)irwinresearch.com ahu(a)ds9a.nl

2 1

RE: Not the best solution, but it takes VeriSign out of the loop
by Mike Damm 16 Sep '03

16 Sep '03

I have received a few replies off list suggesting the same. I already have access to the zones (well, not currently, moved to a new IP block and need to update my source address with them), and if I remember correctly, the agreement I had to sign restricts you from redistributing the data in any way shape and/or form. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: bert hubert [mailto:ahu@ds9a.nl] Sent: Tuesday, September 16, 2003 11:31 AM To: Mike Damm Cc: nanog(a)merit.edu Subject: Re: Not the best solution, but it takes VeriSign out of the loop > You can download the real zones if you want easily enough. Some years ago > all this took was sending a few faxes.

2 1

Eureka/GGN Listening?
by Drew Linsalata 16 Sep '03

16 Sep '03

If anyone from Eureka/GGN is listening, please drop me a note. -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

1 0

Re: What *are* they smoking?
by Rich Braun 16 Sep '03

16 Sep '03

VeriSign stands to gain financially, take a look at this excerpt from an AP news blurb published yesterday: > Ben Turner, VeriSign's vice president for naming services, described the service > as a way to "improve overall usability of the Internet." > > People mistype ".com" and ".net" names some 20 million times daily, Turner said, > and internal studies show "the vast majority of users prefer a page like this > than what they are getting today." >... > Currently, Site Finder sends lost Web surfers to both regular search results and > pay-for-placement listings, which are marked as such. Turner said VeriSign was > partnering with two search companies he would not name. > > He would not disclose how much VeriSign would earn from those companies, with > which it has revenue-sharing arrangements. Anyone find out any details of the contracts which VeriSign has apparently signed to profit from this little venture? -rich

3 2

Vote early...
by Christopher X. Candreva 16 Sep '03

16 Sep '03

When you're done patching your resolver, and openssh, you might want to cast a vote for Stratton in their monthly CEO opinion poll. http://www.forbes.com/2003/05/01/cx_ceointernetpoll.html (Thanks to, uhm, someone who might not want to be named from OpenSRS for passing this along.) ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 0