You experience issues with UDP-dependent network services after you install DNS Server service security update 953230

I'm not sure why there was a design decision to reserve so many UDP ports to take care of the DNS security fix (KB 953230). Thankfully, you can reserve ports that you know a service will need after the DNS Service starts up and you can also specify how many ports are reserved. I'm surprised a few of these well known ports aren't already reserved by default.

You can read how to work around this issue here at KB 956188. So far I have seen and heard it affecting ISA 200x, Exchange and a few other products that need well known UDP ports to operate correctly. I highly suspect but haven't confirmed that an OCS A/V Edge server will need reservations to avoid DNS stealing from its pool. Considering most edge installations are in a DMZ and/or a security hardened install, 99.99% of the installs out there will not be running the DNS Server service anyway.

Posted by Aaron Tiensivu in Exchange, Microsoft, OCS / LCS, Security (MS), Windows OS at 16:56 | Comment (1) | Trackbacks (0)

7534 hits

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Since MS08-037 our ISA Server 2006 started to block all DNS queries coming from our W2K3 DCs which have forwarders configured.

ISA see the many (2500) UDP connections as a flood or attack and block the internal DNS connection to Internet causing all user Internat activity to stop and e-mail to Internet not work.
ISA issued some errors like: "0xcc004000d fwx_e_policy_rules_denied" shown in monitoring, most probably because we have configured the flood protection.

Bulletins did not mention this problem with ISA server. We decided to uninstall the patch (solved the problem) and ask MS how to effectively overcome this issue. Beacuse increasing the "non-TCP connections" did not solved the problem.

#1 Raul Batista on 2008-08-06 11:33 (Reply)

Add Comment