TCP Flaw CVE-2016-5696 Workaround Update

TCP Flaw CVE-2016-5696 Workaround

Update: August 21st, 2016 - RedHat has released RHEL7 Kernel update (kernel-3.10.0-327.28.3.el7.x86_64) for TCP fix but RHEL6 does not yet have a Kernel Update. Once Kernel is updated, you would require a server reboot. Full details here.

Updated both Centmin Mod 123.08stable and 123.09beta01 builds with workaround fixes for TCP Flaw CVE-2016-5696 outlined here. Details for CVE-2016-5696 outlined here. After updating your Centmin Mod installs via below instructions, run centmin.sh once and the workaround will be applied automatically. You can verify the workaround fix is in place via command

Code (Text):

sysctl -a | grep ack_limit                                                           

Which should return output of

Code (Text):

sysctl -a | grep ack_limit                                                           
net.ipv4.tcp_challenge_ack_limit = 999999999

Note, OpenVZ VPS systems are unable to adjust TCP values at server level, so need your web host to do it for you

If for whatever reason the auto fix doesn't apply, you can do it manually via these 2 commands

For CentOS 6 (FYI some web hosts use custom kernels like Linode with 4.6+ kernels) and well CentOS 6 is affected despite using 2.6.x kernels

Code (Text):

echo "net.ipv4.tcp_challenge_ack_limit = 999999999" >> /etc/sysctl.conf; sysctl -p;
sysctl -a | grep ack_limit

---

For CentOS 7

Code (Text):

echo "net.ipv4.tcp_challenge_ack_limit = 999999999" >> /etc/sysctl.d/101-sysctl.conf; sysctl -p;
sysctl -a | grep ack_limit

To update your Centmin Mod builds follow instructions at centminmod.com/upgrade.html and respective version threads below:

• Centmin Mod 1.2.3-eva2000.08 stable install & update thread
• Centmin Mod 123.09beta thread
• Example of centmin.sh menu option 23 git updating code.
• How to upgrade Centmin Mod + backing up customisations

 

Just to clarify on Redhat/CentOS both version 6 and 7 are affected with 2.6.x kernels CVE-2016-5696 - Red Hat Customer Portal

 

Note that also 1.4 billion Android 4.4+ devices are affected by this TCP Flaw. Suggested mitigation is using a VPN encrypted link to the internet on your Android devices. @Jimmy posted a list of VPN providers at https://community.centminmod.com/threads/epic-vpn-comparison-chart.7118/.

 

Update: August 21st, 2016 - RedHat has released RHEL7 Kernel update (kernel-3.10.0-327.28.3.el7.x86_64) for TCP fix but RHEL6 does not yet have a Kernel Update. Once Kernel is updated, you would require a server reboot. Full details here.