Hi I'd like to know if the present version of Bind in CentOS 6 (bind-9.8.2-0.47.rc1.el6_8.1.x86_64) is vulerable to CVE-2016-2776. According to https://www.isc.org/downloads/, version 9.8.x is End-of-Life (EOL) as of Sep 2014. Regards ian
Eero Volotinen
2016-Oct-17 05:49 UTC
[CentOS] Is bind-9.8.2-0.47.rc1.el6_8.1.x86_64 vulnerable
https://access.redhat.com/security/cve/cve-2016-2776 check versions against centos package numbers :) -- Eero 2016-10-17 8:28 GMT+03:00 ????? ??? <ian at ncsa.jp>:> Hi > > I'd like to know if the present version of Bind in CentOS 6 > (bind-9.8.2-0.47.rc1.el6_8.1.x86_64) is vulerable to CVE-2016-2776. > > According to https://www.isc.org/downloads/, version 9.8.x is End-of-Life > (EOL) as of Sep 2014. > > Regards > > ian > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos >
John R Pierce
2016-Oct-17 05:54 UTC
[CentOS] Is bind-9.8.2-0.47.rc1.el6_8.1.x86_64 vulnerable
On 10/16/2016 10:28 PM, ????????? wrote:> I'd like to know if the present version of Bind in CentOS 6 (bind-9.8.2-0.47.rc1.el6_8.1.x86_64) is vulerable to CVE-2016-2776. > > According tohttps://www.isc.org/downloads/, version 9.8.x is End-of-Life (EOL) as of Sep 2014.Red Hat continues to maintain their own fork of 9.8 for EL6, and this RHSA https://rhn.redhat.com/errata/RHSA-2016-1944.html says that version of bind you mention does indeed include the fix to that CVE. CentOS is built from the same SRPM's. -- john r pierce, recycling bits in santa cruz
Phil Wyett
2016-Oct-17 06:01 UTC
[CentOS] Is bind-9.8.2-0.47.rc1.el6_8.1.x86_64 vulnerable
On Mon, 2016-10-17 at 14:28 +0900, ????????? wrote:> Hi > > I'd like to know if the present version of Bind in CentOS 6 (bind-9.8.2-0.47.rc1.el6_8.1.x86_64) is vulerable to CVE-2016-2776. > > According to https://www.isc.org/downloads/, version 9.8.x is End-of-Life (EOL) as of Sep 2014. > > Regards > > ianHi, Querying the current bind-libs changelog shows the CVE has been addressed in the current version. rpm -q --changelog bind-libs | grep CVE-2016-2776 - Fix CVE-2016-2776 Regards Phil -- Blog: https://philwyett-hemi.blogspot.co.uk/ GitLab: https://gitlab.com/philwyett_hemi/ -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: This is a digitally signed message part URL: <http://lists.centos.org/pipermail/centos/attachments/20161017/d9d6217d/attachment-0001.sig>