Subject: Hiding BIND version number

From: "Ricardo Gonz�lez" <[email-masked]>
Date: Fri, 18 Dec 1998 12:02:36 PST

Can you tell me what do I have to do to avoid BIND giving its version 
number to anybody?
We used a Scanning tool against our network, in order to give it a 
higher security level. One of the vulnerabilities it found was:
> Vuln: BIND VERSION
> Desc: BIND running on this host has returned information that may   > 
be useful in an attack.
> FIX: Configure BIND so that it does not return version number. For > 
more information, see Internet Software Consortium at              > 
http:\\www.isc.org.

We went there, but still don´t know how to do this configuration.

We have the version 8.2 of BIND, which comes with LINUX.

Thank you very much.
 
Ricardo González.

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

---

From: Brian Wellington <[email-masked]>
Date: Fri, 18 Dec 1998 16:09:29 -0500 (EST)

> We went there, but still don´t know how to do this configuration.

Try the BIND users mailing list at [email-masked].  This mailing list
is for discussions dealing with DNS security (DNSSEC), not specific
products.

As for your question, I believe it is possible with various hacks, but
there's no simple way to do it.

> We have the version 8.2 of BIND, which comes with LINUX.

I assume you mean 8.1.2, since 8.2 hasn't been released yet.

Brian

---

From: John Gilmore <[email-masked]>
Date: Fri, 18 Dec 1998 13:43:25 -0800

The people who wrote your security scanner are idiots.  Ignore this
warning.  Knowing the version number is only of minor help in exploiting
bugs; the usual way to exploit a bug in BIND is to simply try to exploit
it.  If you succeed, it was the right version; if not, it was a fixed
version.

	John Gilmore

---

From: Jim Duncan <[email-masked]>
Date: Fri, 18 Dec 1998 17:49:10 -0500

> it.  If you succeed, it was the right version; if not, it was a fixed

You're right, and I feel obligated to point out that their logic is 
altogether too typical.  It's simply a misdirected attempt to improve 
their security by fixing the wrong problem.

Here's the statement of the problem:  Our scanner determined that the name 
server is insecure because it revealed a version number that is vulnerable.

Here's the solution:  Fix the name server so it doesn't reveal the version 
number.

Years ago I submitted a bug report to Sun regarding a problem with 
ldconfig.  If any of the directories given as arguments to ldconfig did 
not exist, then the dynamic library cache would be damaged and the system 
would crash with what appeared to be a hardware error.  Somehow the bug 
got submitted as "Bogus first arg to ldconfig trashes cache."  When I got 
back the patched ldconfig from Sun and ran it, sure enough a bogus first 
arg, e.g., "ldconfig /foo /usr/local/lib /usr/lib /lib" would generate a
warning message and skip over the non-existent directory.  But *two* bogus 
arguments, e.g., "ldconfig /foo /foo ..." and down it went.

Something's wrong when folks continue to treat the symptoms rather than the
illness.  How much trouble could it have been to check all of the 
directories instead of just the first one?

I'm sorry to have bored the whole list with this.  Please consider it an 
endorsement of your valuable work, especially when you contemplate the 
bizarre logic that is competing against us outside this list.

	Jim

-- 
[email-masked] | Manager, Network & Information Systems | Member, PSU CERT
 Computing Systems & Networking Group, Applied Research Lab, Penn State Univ.
	      "Objects in calendar are closer than they appear."