Re: Internet Worm

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Mark W. Eichin: "Re: Internet Worm"
• Previous message: Icarus Sparry: "Re: Internet Worm"
• Maybe in reply to: Scott D. Yelich: "Internet Worm"
• Next in thread: F. L. Charles Seeger III: "Re: Internet Worm"

> I think you will find that Sun put a double lookup into
> gethostbyaddr(), to prevent spoofing. This of course goes against
> the Unix spirit of 'do one thing only, but do it well'. This double
> lookup can be enabled with the resolv+ library by using the
> 'nospoof' command in its configuration file.

I think that you will find that you are wrong, and the reverse lookup
actually happens in ypserv, specificly in the part that looks up
addresses via the DNS, not the routine in libc.  If you still think
I'm wrong, I invite you to disassemble gethostent.o from libc.a and
take a look for anything that might be code that does a reverse lookup.

The comments about 'nospoof' and resolv+ are accurate.

Jim

• Next message: Mark W. Eichin: "Re: Internet Worm"
• Previous message: Icarus Sparry: "Re: Internet Worm"
• Maybe in reply to: Scott D. Yelich: "Internet Worm"
• Next in thread: F. L. Charles Seeger III: "Re: Internet Worm"