Posts by John Dickson

World's biggest ISPs drag feet on critical DNS patch

Re: "port range too narrow" or "ports may follow a predictable pattern"

Anonymous Coward said:

"Does this mean that subscribers who are getting the "port range too narrow" or "ports may follow a predictable pattern" test error are using name servers that are not patched properly?"

Well, my latest tests of Demon produce:

"Your ISP's name server, 194.159.187.38, appears to be using the name server written by Nominum, which has effective protection against the newly discovered attacks despite the limited port range. Nominum is working to expand the port range for even greater protection, but there is no reason for concern at this time."

but also

"Your name server, at 194.159.187.34, may be safe, but the NAT/Firewall in front of it appears to be interfering with its port selection policy. The difference between largest port and smallest port was only 171."

(which is the same as previously reported for this server)

So now I'm confused. Are Demon using different versions of Nominum on different servers? Or is their patching not complete? Perhaps someone who is more savvy than me could explain what's going on here.

RE: Verizon and DEMON

"Demon Internet was reported as potentially being vulnerable"

No. It produces similar messages to that produced by Verizon e.g

'Your name server, at 194.159.187.34, may be safe, but the NAT/Firewall in front of it appears to be interfering with its port selection policy. The difference between largest port and smallest port was only 247.

Please talk to your firewall or gateway vendor -- all are working on patches, mitigations, and workarounds.'