bogus info for root NS (broadcast addr!)

Dear colleagues,

rather nasty bogus info for NS.NIC.DDN.MIL is spreading, and your host already
got it:


; <<>> DiG 2.0 <<>> @nic.funet.fi NS.NIC.DDN.MIL. any 
;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 10
;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 2, Addit: 2
;; QUESTIONS: 
;;	NS.NIC.DDN.MIL, type = ANY, class = IN

;; ANSWERS:
NS.NIC.DDN.MIL.	517916	A	192.112.36.4
NS.NIC.DDN.MIL.	131377	A	192.112.36.255

;; AUTHORITY RECORDS:
NIC.DDN.MIL.	205986	NS	NIC.DDN.MIL.
NIC.DDN.MIL.	205986	NS	DIIS-DEV.DDN.MIL.

;; ADDITIONAL RECORDS:
NIC.DDN.MIL.	205986	A	192.112.36.5
DIIS-DEV.DDN.MIL.	205986	A	192.112.38.89

;; Sent 1 pkts, answer found in time: 1120 msec 
;; FROM: heinz to SERVER: nic.funet.fi  128.214.6.100
;; WHEN: Tue Aug 24 14:57:50 1993
;; MSG SIZE  sent: 32  rcvd: 144

(for servers of the other To; addressees please see trace at the bottom)

We don't have yet an idea about the source for this;  I would not be too
surprised if some misconfigured server in Germany is the source - but as
it already spread to Finland, probably warning should be distributed
more widely.

Any hints about possible sources for the bad A record would be appreciated.
(so far I have only seen TTLs of upto 160000, and most in teh range of 130000)

Best regards,
  Ruediger


Ruediger Volk
Universitaet Dortmund, Informatik IRB				DE-NIC
D-44221 Dortmund, Germany

E-Mail: rv at Informatik.Uni-Dortmund.DE
Phone:  +49 231 755 4760                 Fax:  +49 231 755 2386




; <<>> DiG 2.0 <<>> @dfnnoc.GMD.DE NS.NIC.DDN.MIL. 
;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 10
;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 8, Addit: 13
;; QUESTIONS: 
;;	NS.NIC.DDN.MIL, type = A, class = IN

;; ANSWERS:
NS.NIC.DDN.MIL.	494406	A	192.112.36.4
NS.NIC.DDN.MIL.	129880	A	192.112.36.255

;; AUTHORITY RECORDS:
.	494406	NS	NS.INTERNIC.NET.
.	494406	NS	AOS.ARL.ARMY.MIL.
.	494406	NS	KAVA.NISC.SRI.COM.
.	494406	NS	C.NYSER.NET.
.	494406	NS	TERP.UMD.EDU.
.	494406	NS	NS.NASA.GOV.
.	494406	NS	NIC.NORDU.NET.
.	494406	NS	NS.NIC.DDN.MIL.

;; ADDITIONAL RECORDS:
NS.INTERNIC.NET.	500936	A	198.41.0.4
AOS.ARL.ARMY.MIL.	517638	A	128.63.4.82
AOS.ARL.ARMY.MIL.	517638	A	192.5.25.82
AOS.ARL.ARMY.MIL.	32753	A	26.3.0.29
KAVA.NISC.SRI.COM.	500936	A	192.33.33.24
KAVA.NISC.SRI.COM.	86839	A	223.184.64.35
C.NYSER.NET.	500936	A	192.33.4.12
TERP.UMD.EDU.	500936	A	128.8.10.90
NS.NASA.GOV.	500936	A	128.102.16.10
NS.NASA.GOV.	500936	A	192.52.195.10
NIC.NORDU.NET.	500936	A	192.36.148.17
NS.NIC.DDN.MIL.	494406	A	192.112.36.4
NS.NIC.DDN.MIL.	129880	A	192.112.36.255

;; Sent 1 pkts, answer found in time: 779 msec 
;; FROM: heinz to SERVER: dfnnoc.GMD.DE  192.88.108.8
;; WHEN: Tue Aug 24 15:22:53 1993
;; MSG SIZE  sent: 32  rcvd: 475



; <<>> DiG 2.0 <<>> @deneb.dfn.de NS.NIC.DDN.MIL. 
;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 10
;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 2, Addit: 2
;; QUESTIONS: 
;;	NS.NIC.DDN.MIL, type = A, class = IN

;; ANSWERS:
NS.NIC.DDN.MIL.	445700	A	192.112.36.4
NS.NIC.DDN.MIL.	129700	A	192.112.36.255

;; AUTHORITY RECORDS:
NIC.DDN.MIL.	166305	NS	NIC.DDN.MIL.
NIC.DDN.MIL.	166305	NS	DIIS-DEV.DDN.MIL.

;; ADDITIONAL RECORDS:
NIC.DDN.MIL.	166305	A	192.112.36.5
DIIS-DEV.DDN.MIL.	166305	A	192.112.38.89

;; Sent 1 pkts, answer found in time: 579 msec 
;; FROM: heinz to SERVER: deneb.dfn.de  192.76.176.9
;; WHEN: Tue Aug 24 15:25:43 1993
;; MSG SIZE  sent: 32  rcvd: 144