CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2021/10/27 14:57:06
Modified files:
net/isc-bind : Makefile distinfo
net/isc-bind/patches: patch-configure_ac
patch-lib_isc_unix_socket_c
Log message:
update to BIND 9.16.22 - CVE-2021-25219
"Lame cache can be abused to severely degrade resolver performance"
Exploitation of broken authoritative servers using a flaw in response
processing can cause degradation in BIND resolver performance. The way the
lame cache is currently designed makes it possible for its internal data
structures to grow almost infinitely, which may cause significant delays in
client query processing.
The purpose of a resolver's lame cache is to ensure that if an authoritative
server responds to a resolver's query in a specific broken way, subsequent
client queries for the same <QNAME, QTYPE> tuple do not trigger further
queries to the same server for a configurable amount of time. The lame cache
is enabled by setting the lame-ttl option in named.conf to a value greater
than 0. That option is set to lame-ttl 600; in the default configuration,
which means the lame cache is enabled by default.
Impact:
Authoritative-only BIND 9 servers are NOT vulnerable to this flaw.
A successful attack exploiting this flaw causes a named resolver to spend most
of its CPU time on managing and checking the lame cache. This results in
client queries being responded to with large delays, and increased likelihood
of DNS timeouts on client hosts.
