| 1 |
On Oct 18, 2011 12:14 PM, "Norman Rieß" <norman@×××××××××.org> wrote: |
| 2 |
> |
| 3 |
> -----BEGIN PGP SIGNED MESSAGE----- |
| 4 |
> Hash: SHA1 |
| 5 |
> |
| 6 |
> On 10/17/11 20:06, Pandu Poluan wrote: |
| 7 |
> > |
| 8 |
> > On Oct 17, 2011 6:44 PM, "Norman Rieß" <norman@×××××××××.org |
| 9 |
> > <mailto:norman@×××××××××.org>> wrote: |
| 10 |
> >> |
| 11 |
> >> |
| 12 |
> >> Hello, |
| 13 |
> >> |
| 14 |
> >> sorry to interrupt this thread, but this probably means, you did not |
| 15 |
> >> perform any kernel updates on that machine for over two years and |
| 16 |
> >> therefore the system is vulnarable to some kernel bugs which where |
| 17 |
> >> discovered during this time. On a DNS machine a privilege escalation |
| 18 |
bug |
| 19 |
> >> is even more severe. I strongly recommend to secure this machine. |
| 20 |
> > |
| 21 |
> > That depends on what Kai meant with "uptime". Maybe he meant the VMs |
| 22 |
> > (he's using Xen, after all) never needs a restart, but the BIND service |
| 23 |
> > still gets regular update and the consequent service-restart. |
| 24 |
> > |
| 25 |
> |
| 26 |
> Every Xen VM is running its own kernel and needs to be restarted or |
| 27 |
> kexec'ed when this kernel is updated. If this is not the case, the VM is |
| 28 |
> vulnerable to kernel bugs just as any other physical system, even if the |
| 29 |
> host on which the VM is running is secure. |
| 30 |
> I assume BIND is updated and restarted as needed, but that is not enough. |
| 31 |
|
| 32 |
Does it matter if the DNS server is behind a firewall that allows only |
| 33 |
TCP+UDP traffic to port 53? |
| 34 |
|
| 35 |
Rgds, |
Archives