Microsoft to patch zero-day DNS flaw

Not so fast...: What security-concerned admin would rely solely on perimeter firewalling as a means of protecting against a vulnerability that could be used to remotely own entire domains? Remember, DCs are typically DNS servers, also.

Furthermore, this vulnerability could be reached over ports 139, 445, etc., which makes firewalling impractical for a DC. So, sure, you should be blocking RPC/SMB inbound from the perimeter, but that doesn't totally eliminate the threat. Just think rogue employees or roving portables, and you'll understand why a remote root on a DC that is accessible from only the internal LAN is *still* _very bad news_.; Posted by: SecurityGeek_z Posted on: 05/07/07 You are currently: a Guest | Members login | Terms of Use

Reply to Story Reply to Message

Subscribe to this discussion via Email or RSS

Agreed ITguy5678 | 05/07/07

Any given home user epcraig | 05/07/07

Firewalling DNS gotitright | 05/07/07

Not so fast... SecurityGeek_z | 05/07/07

Loverock, you are an idiot... SecurityGeek_z | 05/07/07

Agree w/ Everything Except rkuhn040172@... | 05/07/07

Drat, They Did It Again astro_z | 05/08/07

What do you think?

Thought-provoking progressive ideas on diverse topics that intersect with technology, business, and life, and matter to the world at large. Visit SmartPlanet
More from IBM
How to Drive Better Business Outcomes with Exceptional Web Experiences Download the eBook
Driving Business Agility through SOA Connectivity & Integration Read the White Paper from IBM
Linking Decisions and Information for Organizational Performance Read the Tom Davenport study