The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Dns Security

Discussion in 'Security' started by dinho, Apr 1, 2013.

  1. dinho

    dinho Member

    Oct 1, 2008
    Likes Received:
    Trophy Points:

    See this news to the source

    "It has been revealed that a malicious regular expression can cause a denial-of-service of the open source BIND DNS server on Linux and Unix systems. Other programs using BIND's libdns are also potentially vulnerable to the same attack. The critical bug allows attacker to cause excessive memory consumption by the named process which could lead to the daemon using all available memory on the affected machine; this could lead to the crashing of BIND and detrimentally affect other services running on the same server.

    The problem has been reported as CVE-2013-2266 and only affects Linux and Unix versions of BIND – the flaw is not present in Windows versions of the program. Vulnerable versions include 9.7.x, 9.8.0 to 9.8.5b1 and 9.9.0 to 9.9.3b1 of BIND. Versions prior to BIND 9.7.0 are not vulnerable; BIND 10 is not affected either.

    Fixed versions of BIND have been released as BIND 9.9.2-P2 and 9.8.4-P2, BIND 9.7 has already reached end of life and is no longer being maintained. Applications that use BIND's libdns library are also affected and should be updated as quickly as possible. As a workaround, developers can compile libdns with regex functionality disabled.

    The Internet Systems Consortium (ISC), which maintains BIND, points out that the flaw is not very difficult to exploit and recommends immediate action by owners of named servers to ensure that their systems are not affected."

    Critical vulnerability in BIND 9 regular expression handling - The H Security: News and Features

    I wonder which version that supports cpanel, which recommends the cpanel.
    I use cpanel version 11.36
  2. Eric

    Eric Administrator
    Staff Member

    Nov 25, 2007
    Likes Received:
    Trophy Points:
    cPanel Access Level:
    Root Administrator

    Bind/Named are provided from upstream operating system vendors. The latest update was provided by red hat according to and was patched in CentOS too.

    I verified this on my Cent6 system.

    grimlock ~ # rpm -qa --last|grep bind
    bind-utils-9.8.2-0.17.rc1.el6_4.4.x86_64      Fri 29 Mar 2013 04:14:15 AM CDT
    bind-devel-9.8.2-0.17.rc1.el6_4.4.x86_64      Fri 29 Mar 2013 04:14:15 AM CDT
    bind-9.8.2-0.17.rc1.el6_4.4.x86_64            Fri 29 Mar 2013 04:14:15 AM CDT
    bind-libs-9.8.2-0.17.rc1.el6_4.4.x86_64       Fri 29 Mar 2013 04:14:14 AM CDT
    grimlock ~ # rpm -qa --changelog bind |head
    * Wed Mar 27 2013 Adam Tkac <atkac redhat com> 32:9.8.2-0.17.rc1.4
    - fix  CVE-2013-2266
    - ship dns/rrl.h in -devel subpkg
    This command should work for CentHat5 too.


Share This Page