odd behavior in bind-8.2.2_P3 (fwd) - "illegitimate COM server" - more

[jlewis at lewis.org]

On Thu, 7 Sep 2000 Ted_Rule at flextech.co.uk wrote:

> Hence the issue is presumably only a problem for very old name servers
> directly querying the COM servers. Most modern firewall and ISP's DNS
> servers are going to be recent enough to catch this problem and avoid
> passing on the infection. Individual client resolvers will see the
> broken NS records in the responses, but very little - if anything - at
> the client resolver end will be using the Authority section anyway.

Define "very old name servers".  Unfortunately, bind-8.2.2_P3 is the
latest from some vendors.  The one I keep running into this problem on
uses 1 forwarder.  That was also running bind-8.2.2_P3, but was upgraded
to bind-8.2.2_P5 to see if that would help.  It didn't.  If I turn off
forwarding, this ceases to be a problem, even on the 8.2.2_P3 systems.

----------------------------------------------------------------------
 Jon Lewis *jlewis at lewis.org*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |  
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________