Updating Systems for glibc DNS Vulnerability and Workaround

Published 2016-02-17

This post explains how to update your servers and how you can use iptables as workaround to fix DNS vulnerability found in glibc (CVE-2015-7547).

By now all good sysadmins should know that a new DNS vulnerability has been found and if you didn't then just read this blog post by Google's researchers.

I did update the Debian/Ubuntu servers with the tipical commands:

$ sudo apt-get update
$ sudo apt-get upgrade

and the CentOS/RedHat ones with:

$ sudo yum clean all
$ sudo yum update
$ sudo systemctl daemon-reexe

last command is to avoid to reboot your system.

Currently, I don't work with any Suse servers but in case you need to, this is the command:

# zypper up

Of course I also wanted to patch my Fedora but after running the usual command:

$ sudo yum update

I notice that glibc wasn't updated yet, ... uhmm I suppose I have to wait a little bit for the patch meanwhile I'd like to be protected, and this is the workaround to get you covered by using iptables.

$ sudo iptables -I INPUT -p udp --sport 53 -m length --length 511:65535 -j DROP
$ sudo iptables -I INPUT -p udp --dport 53 -m length --length 511:65535 -j DROP

to check that rules are inserted correctly you can use:

$ sudo iptables -L -nv|grep 53

Danilo

linux