In Progress [UPS-291] cPanel DNSOnly: SAD DNS / DNS Spoofing protection

[MindServer]

Hi,

Today KernelCare writed a post in her blog where talk about SAD DNS. I have various web servers (with WHM/cPanel) and one Cluster DNS (whith cPanel DNSOnly).

"WHM/cPanel" and "cPanel DNSOnly" have protection against SAD DNS / DNS Spoofing?. Or I need do anything for protect the domains and DNS against this attacks?.

I have:

Web servers: CloudLinux 7 + WHM/cPanel
Cluster DNS: CentOS 7 + cPanel DNSOnly

All updated to latest version.

Thank you very much. Have a nice day.

 

[cPanelChristine]

Geretings.

We were not able to locate the KernelCare post that you mentioned, though we do know that there is currently a known vulnerability that is being investigated under these links:

1894579 – (CVE-2020-25705) CVE-2020-25705 kernel: ICMP rate limiting can be used for DNS poisoning attack

bugzilla.redhat.com

Red Hat Customer Portal - Access to 24x7 support and knowledge

access.redhat.com

We filed an internal case for tracking as well, which I will update this post's title with. For now it would appear that we are awaiting on an update on these two posts to see what the next course of action is.

 

[cPanelChristine]

Hello,

I also forgot to mention, though this does not seem to affect RH/CentOS/CloudLinux 6 servers from the information that we found so far.

 

[MindServer]

Geretings.

We were not able to locate the KernelCare post that you mentioned, though we do know that there is currently a known vulnerability that is being investigated under these links:

Thank you very much. This is the post, for you can check additional information: KernelCare Patches for SAD DNS Are On The Way

Most of us use CloudLinux 7 and CentOS 7, the vulnerabily affect to this OS?.

I hope this will be solved soon before have problems. Have a nice day.

 

[cPanelChristine]

Greetings,

The vulnerability appears to affect the kernel from what we have found so far. It may be worth mentioning that there are some suggestions on the bug report here that may help with getting around the problem. Unless this is actively causing issues, we would recommend waiting on updates.

 

[MindServer]

Hi,

This vulnerability is solved in last "CentOS 7 + cPanel DNSOnly" version?.

Have a nice day.

 

[cPRex]

@MindServer - it looks like this has been included in kernel release 5.10. However, that hasn't been applied to most operating systems just yet as the release was just last week:

1894579 – (CVE-2020-25705) CVE-2020-25705 kernel: ICMP rate limiting can be used for DNS poisoning attack

bugzilla.redhat.com