ISC BIND vulnerabilities are now public (CVE-2016-1285, CVE-2016-1286, CVE-2016-2088)

po1yak

• March 17, 2016 11:09

Hello, Can somebody provide explanation for the thread? Is WHM/cPanel servers is affected by this vulnerabilities? Does it need to do any updates or re-configurations? How I can check if my version of Bind is affected by this vulnerabilities? CentOS release 6.7 (Final) WHM 54.0 (build 19) BIND 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 thanks in advance, Sergey Polyakov.

• 

  po1yak

  • March 17, 2016 16:36

  in addition link to the news: oss-sec: ISC BIND vulnerabilities are now public (CVE-2016-1285, CVE-2016-1286, CVE-2016-2088)

  0
• 

  JacobPerkins

  • March 17, 2016 18:12

  Hi, Bind is provided upstream by CentOS, and not directly from cPanel. CentOS has released updates upstream already for Bind, and if your server updated last night, you should have those updates already.
  root@cpanel [~]# grep -i bind /var/log/yum.log Jan 27 21:04:27 Updated: 32:bind-libs-9.8.2-0.37.rc1.el6_7.6.x86_64 Jan 27 21:04:27 Updated: 32:bind-utils-9.8.2-0.37.rc1.el6_7.6.x86_64 Jan 27 21:04:28 Updated: 32:bind-devel-9.8.2-0.37.rc1.el6_7.6.x86_64 Jan 27 21:04:31 Updated: 32:bind-9.8.2-0.37.rc1.el6_7.6.x86_64 Mar 16 21:06:28 Updated: 32:bind-libs-9.8.2-0.37.rc1.el6_7.7.x86_64 Mar 16 21:06:28 Updated: 32:bind-utils-9.8.2-0.37.rc1.el6_7.7.x86_64 Mar 16 21:06:31 Updated: 32:bind-9.8.2-0.37.rc1.el6_7.7.x86_64 Mar 16 21:06:32 Updated: 32:bind-devel-9.8.2-0.37.rc1.el6_7.7.x86_64
  

  0
• 

  Eric

  • March 17, 2016 20:09

  Howdy, You can check the changelog of any package using this command:
  root@ratchet [~]# rpm -qa --changelog bind|head * Tue Mar 08 2016 Tomas Hozza - 32:9.9.4-29.3 - Fix CVE-2016-1285 and CVE-2016-1286 * Mon Jan 18 2016 Tomas Hozza - 32:9.9.4-29.2 - Fix CVE-2015-8704 * Mon Dec 14 2015 Tomas Hozza - 32:9.9.4-29.1 - Fix CVE-2015-8000 * Wed Sep 02 2015 Tomas Hozza - 32:9.9.4-29
  Thanks!

  0
• 

  po1yak

  • March 17, 2016 20:29

  Guys, thanks a lot for the quick answers! provided information absolutely enough for me.

  0

Please sign in to leave a comment.