From owner-freebsd-security  Sun Jun  2 11:50:49 2002
Delivered-To: freebsd-security@freebsd.org
Received: from cheer.mahoroba.org (flets19-004.kamome.or.jp [218.45.19.4])
	by hub.freebsd.org (Postfix) with ESMTP
	id E6FD037B401; Sun,  2 Jun 2002 11:50:40 -0700 (PDT)
Received: from piano.mahoroba.org (IDENT:MPF7/AL28zIIbHobNx76t0frSrVrKO2un/nlgTMXkE49SqDVN3sVpb1wXXzCcSWT@piano.mahoroba.org [IPv6:2001:200:301:0:240:96ff:fe48:4ea8])
	(user=ume mech=CRAM-MD5 bits=0)
	by cheer.mahoroba.org (8.12.3/8.12.3) with ESMTP/inet6 id g52IoXHo011859
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO);
	Mon, 3 Jun 2002 03:50:34 +0900 (JST)
	(envelope-from ume@mahoroba.org)
Date: Mon, 03 Jun 2002 03:50:33 +0900
Message-ID: <ygelm9xikg6.wl@piano.mahoroba.org>
From: Hajimu UMEMOTO <ume@mahoroba.org>
To: "Crist J. Clark" <cjc@FreeBSD.ORG>
Cc: Drew Tomlinson <drew@mykitchentable.net>, security@FreeBSD.ORG
Subject: Re: Security Messages re: hosts.allow?
In-Reply-To: <20020602113409.F20911@blossom.cjclark.org>
References: <007e01c20a47$7fabb370$1b01a8c0@TAGALONG>
User-Agent: xcite1.38> Wanderlust/2.8.1 (Something) SEMI/1.14.3 (Ushinoya)
 FLIM/1.14.3 (=?ISO-8859-4?Q?Unebigory=F2mae?=) APEL/10.3 Emacs/21.2
 (i386--freebsd) MULE/5.0 (=?ISO-2022-JP?B?GyRCOC1MWhsoQg==?=)
X-Operating-System: FreeBSD 4.6-PRERELEASE
MIME-Version: 1.0 (generated by SEMI 1.14.3 - "Ushinoya")
Content-Type: text/plain; charset=US-ASCII
X-Virus-Scanned: by AMaViS-perl11-milter (http://amavis.org/)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi,

>>>>> On Sun, 2 Jun 2002 11:34:09 -0700
>>>>> "Crist J. Clark" <crist.clark@attbi.com> said:

crist.clark>   server1.camelweb.com.tw.  23h59m43s IN CNAME  dns.camelweb.com.tw.
crist.clark>   server1.camelweb.com.tw.  23h59m43s IN A  210.59.224.44
crist.clark>   dns.camelweb.com.tw.    22h47m42s IN A  210.59.224.42

crist.clark>   42.224.59.210.in-addr.arpa.  9h1m47s IN PTR  server1.camelweb.com.tw.

crist.clark> But from the looks of it, these DNS entries themselves do not look
crist.clark> malicious.

No, CNAME RR cannot co-exist with A RR.

Sincerely,

--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
ume@mahoroba.org  ume@bisd.hitachi.co.jp  ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message