On Tue, Dec 19, 2006 at 03:58:36PM -0600, Scott Pate wrote:
Plugin 10539 reported a DNS server as allowing recursive queries. I
tried to verify this with:
...
if ( (pk["flags"] & 0x8085) == 0x8080 )
security_warning(port:53, proto:"udp");
...
It looks like nessus is relying on the 'ra' bit to determine if
recursion is available...correct?
Yes.
If this is the case, why does it report this since the response (from
below) is 0x8082?
Look at the code - 0x8082 & 0x8085 == 0x8080, right? So where's 0x8085
come from? Well, 0x8000 indicates the message is a response and 0x0080
indicates recursion is available.
Also, when the script builds the query, it apparently sets the DNS flags
to "dns["flags"] = 0x0100;", but from the packet capture you see that
the query is actually 0x0000. Is this correct?
No, it's a bug. Thanks for pointing it out. I've just fixed it.
George
--
[EMAIL PROTECTED]
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
