erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: July 28, 2015

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: BIND CVE-2015-5477: 2015 TKEY DNS Crash Bug Now in KEV. Operators of BIND 9 builds older than 9.9.7-P2 or 9.10.2-P3, including old Linux servers, appliances and network devices that embed BIND, especially ones that answer DNS from the internet.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2015-5477

BIND CVE-2015-5477: 2015 TKEY DNS Crash Bug Now in KEV

Any BIND release from the past decade is fixed, so most teams have nothing to do; the real risk is forgotten DNS servers and appliances still running pre-mid-2015 BIND, which one packet can knock offline.

Must act: Operators of BIND 9 builds older than 9.9.7-P2 or 9.10.2-P3, including old Linux servers, appliances and network devices that embed BIND, especially ones that answer DNS from the internet.

Can relax: Anyone on a BIND release from August 2015 or later, distro packages patched since then, other DNS servers (Unbound, PowerDNS, dnsmasq), and teams using managed DNS.

  1. Find every named instance, including inside appliances, and record its version with named -v.
  2. Upgrade anything older than 9.9.7-P2 or 9.10.2-P3 to a supported BIND release or your vendor's fixed package or firmware, then restart named.
  3. If an appliance cannot be updated, keep untrusted networks from reaching its DNS port; ISC says BIND's own ACLs do not prevent the crash.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.