Hello everyone,
I've been seeing these syslog messages for about a week on a FreeBSD
server running BIND 9.4.3-P1:
Jan 25 02:35:21 asimov named[145]: client 206.71.158.30#138: error
sending response: permission denied
Jan 25 03:43:32 asimov named[145]: client 206.71.158.30#138: error
sending response: permission denied
Jan 25 04:49:59 asimov named[145]: client 206.71.158.30#139: error
sending response: permission denied
Jan 25 05:15:40 asimov named[145]: client 66.230.160.1#139: error
sending response: permission denied
Jan 25 07:45:11 asimov named[145]: client 206.71.158.30#139: error
sending response: permission denied
Jan 25 07:56:26 asimov named[145]: client 206.71.158.30#138: error
sending response: permission denied
Jan 25 08:10:29 asimov named[145]: client 206.71.158.30#138: error
sending response: permission denied
Jan 25 08:54:34 asimov named[145]: client 206.71.158.30#138: error
sending response: permission denied
Jan 25 09:16:41 asimov named[145]: client 206.71.158.30#138: error
sending response: permission denied
Jan 25 10:03:51 asimov named[145]: client 206.71.158.30#445: error
sending response: permission denied
Ports 135-139 and 445 are denied by the firewall on the outside
interface. It looks like it might be some kind of Windows exploit, but
I've Googled and searched the BIND mailing lists, and haven't found any
clues yet.
Has anybody else seen this?
Thanks!
Andre
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
