-1

I have read that the vulnerability is triggered by a DNS response. How can you be vulnerable if you trust your DNS servers?

May your DNS servers redirect your request to other DNS that may be malicious? Is not the DNS who asks those other DNS servers and give you the response? The malicious response may traverse your trusted DNS and exploit you?

3

While it is lame to simply cite a third party, the report from Redhat actually contains clear answers to your questions. From the FAQ part of https://access.redhat.com/articles/2161461:

  1. Can a trusted recursive DNS resolver protect against this issue?
    A trusted recursive resolver, in a default, protocol-compliant configuration, cannot mitigate this issue because potential exploits could involve syntactically well-formed DNS responses. Restricting response sizes to to 1023 bytes can mitigate the issue if the network between the recursive resolver and clients using affected versions of glibc is trusted, and potential attackers cannot spoof the source address of the recursive resolver. The packet size restrictions have to be applied to the responses the recursive resolver generates, not the responses it receives from the Internet. Such packet size restrictions break some DNS-related services, including DNSSEC. Apart from the size aspect, there is no way for DNS recursors to detect and block attack traffic.

  2. Is it sufficient to upgrade Internet-facing DNS servers and recursive resolvers?
    No, the glibc packages on all hosts (both servers and clients) need to be updated.

But in case you have only an internal network which no access to the outside (which means no direct or indirect access to the outside for the DNS servers too) and you trust the setup of your DNS and you are not vulnerable to DNS spoofing then you should probably be safe because it is impossible for an attacker to even partially control the DNS responses within your network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.