Security Alert: DNS Security Vulnerability
Earlier this week Dan Kaminsky announced a major security vulnerability in the 25 year old DNS protocol. DNS is used to translate human readable addresses such as www.google.com into IP addresses that computers use to talk to one another across networks such as the Internet. Kaminsky, a security researcher with IO Active, stressed that the issue was in the design of DNS and therefore affected software across all operating systems.
Of course, the most popular DNS software on Linux is BIND, which is shipped with almost every distribution. Kaminsky worked with many major software vendors to ensure that security updates were available simultaneously. Debian, Red Hat, Ubuntu, and many other distributions have already provided updated versions of BIND. One thing to note is that if you are running BIND 8 servers anywhere you should take this opportunity to upgrade to BIND 9. The BIND 8 codebase is no longer supported, and security updates are not available.
Even though this is a protocol issue, some software and services are not affected. Systems using Dan Bernstein's djbdns package are not vulnerable to this type of attack. Users of PowerDNS and OpenDNS are also not susceptible. Kaminsky has provided a tool on his website that you can use to check your DNS service.
Although this is a major security issue, the details of the exploit have not yet been released by Kaminsky. The coordinated effort with vendors gave them a chance to patch their systems before Kaminsky takes the stage at the annual Black Hat security conference next month in Las Vegas. It is expected that he will discuss the vulnerability in depth at the conference, at which point exploits are sure to begin appearing. An Executive Overview (PDF) of the vulnerability is available, along with the CERT Advisory. A list of the affected systems is given near the bottom of the advisory.
If you manage DNS services please take time to update your system with the latest software available.
Cory Wright https://www.corywright.org/
|Happy Birthday Linux||Aug 25, 2016|
|ContainerCon Vendors Offer Flexible Solutions for Managing All Your New Micro-VMs||Aug 24, 2016|
|Updates from LinuxCon and ContainerCon, Toronto, August 2016||Aug 23, 2016|
|NVMe over Fabrics Support Coming to the Linux 4.8 Kernel||Aug 22, 2016|
|What I Wish I’d Known When I Was an Embedded Linux Newbie||Aug 18, 2016|
|Pandas||Aug 17, 2016|
- Happy Birthday Linux
- ContainerCon Vendors Offer Flexible Solutions for Managing All Your New Micro-VMs
- Updates from LinuxCon and ContainerCon, Toronto, August 2016
- New Version of GParted
- What I Wish I’d Known When I Was an Embedded Linux Newbie
- Tor 0.2.8.6 Is Released
- NVMe over Fabrics Support Coming to the Linux 4.8 Kernel
- All about printf
- Blender for Visual Effects
- A New Project for Linux at 25
With all the industry talk about the benefits of Linux on Power and all the performance advantages offered by its open architecture, you may be considering a move in that direction. If you are thinking about analytics, big data and cloud computing, you would be right to evaluate Power. The idea of using commodity x86 hardware and replacing it every three years is an outdated cost model. It doesn’t consider the total cost of ownership, and it doesn’t consider the advantage of real processing power, high-availability and multithreading like a demon.
This ebook takes a look at some of the practical applications of the Linux on Power platform and ways you might bring all the performance power of this open architecture to bear for your organization. There are no smoke and mirrors here—just hard, cold, empirical evidence provided by independent sources. I also consider some innovative ways Linux on Power will be used in the future.Get the Guide