dinho

Member
Oct 1, 2008
16
0
51
Dear

See this news to the source



"It has been revealed that a malicious regular expression can cause a denial-of-service of the open source BIND DNS server on Linux and Unix systems. Other programs using BIND's libdns are also potentially vulnerable to the same attack. The critical bug allows attacker to cause excessive memory consumption by the named process which could lead to the daemon using all available memory on the affected machine; this could lead to the crashing of BIND and detrimentally affect other services running on the same server.

The problem has been reported as CVE-2013-2266 and only affects Linux and Unix versions of BIND – the flaw is not present in Windows versions of the program. Vulnerable versions include 9.7.x, 9.8.0 to 9.8.5b1 and 9.9.0 to 9.9.3b1 of BIND. Versions prior to BIND 9.7.0 are not vulnerable; BIND 10 is not affected either.

Fixed versions of BIND have been released as BIND 9.9.2-P2 and 9.8.4-P2, BIND 9.7 has already reached end of life and is no longer being maintained. Applications that use BIND's libdns library are also affected and should be updated as quickly as possible. As a workaround, developers can compile libdns with regex functionality disabled.

The Internet Systems Consortium (ISC), which maintains BIND, points out that the flaw is not very difficult to exploit and recommends immediate action by owners of named servers to ensure that their systems are not affected."


Critical vulnerability in BIND 9 regular expression handling - The H Security: News and Features


I wonder which version that supports cpanel, which recommends the cpanel.
I use cpanel version 11.36
 

Eric

Well-Known Member
Nov 25, 2007
754
14
143
Texas
cPanel Access Level
Root Administrator
Twitter
Howdy,

Bind/Named are provided from upstream operating system vendors. The latest update was provided by red hat according to https://access.redhat.com/security/cve/CVE-2013-2266 and was patched in CentOS too.

I verified this on my Cent6 system.

Code:
grimlock ~ # rpm -qa --last|grep bind
bind-utils-9.8.2-0.17.rc1.el6_4.4.x86_64      Fri 29 Mar 2013 04:14:15 AM CDT
bind-devel-9.8.2-0.17.rc1.el6_4.4.x86_64      Fri 29 Mar 2013 04:14:15 AM CDT
bind-9.8.2-0.17.rc1.el6_4.4.x86_64            Fri 29 Mar 2013 04:14:15 AM CDT
bind-libs-9.8.2-0.17.rc1.el6_4.4.x86_64       Fri 29 Mar 2013 04:14:14 AM CDT
grimlock ~ # rpm -qa --changelog bind |head
* Wed Mar 27 2013 Adam Tkac <atkac redhat com> 32:9.8.2-0.17.rc1.4
- fix  CVE-2013-2266
- ship dns/rrl.h in -devel subpkg
This command should work for CentHat5 too.

Thanks!