Public bug reported:
An important stable version has been released a while back. But Debian
has not packaged it yet. Please do. ftp://ftp.isc.org/isc/bind9/9.10.4
/RELEASE-NOTES-bind-9.10.4.txt
Security Fixes
* Duplicate EDNS COOKIE options in a response could trigger an
assertion failure. This flaw is disclosed in CVE-2016-2088. [RT
#41809]
* The resolver could abort with an assertion failure due to improper DNAME
handling when parsing fetch reply messages. This flaw is disclosed in
CVE-2016-1286. [RT #41753]
* Malformed control messages can trigger assertions in named and
rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
* Certain errors that could be encountered when printing out or
logging an OPT record containing a CLIENT-SUBNET option could be
mishandled, resulting in an assertion failure. This flaw is
disclosed in CVE-2015-8705. [RT #41397]
* Specific APL data could trigger an INSIST. This flaw is disclosed in
CVE-2015-8704. [RT #41396]
* Incorrect reference counting could result in an INSIST failure if a
socket error occurred while performing a lookup. This flaw is
disclosed in CVE-2015-8461. [RT#40945]
* Insufficient testing when parsing a message allowed records with an
incorrect class to be be accepted, triggering a REQUIRE failure when those
records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT
#40987]
New Features
* The following resource record types have been implemented: AVC,
CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
* Added a warning for a common misconfiguration involving forwarded RFC
1918 and IPv6 ULA (Universal Local Address) zones.
* Contributed software from Nominum is included in the source at
contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the
performance of authoritative DNS servers, resperf for testing the
resolution performance of a caching DNS server, resperf-report for
generating a resperf report in HTML with gnuplot graphs, and
queryparse to extract DNS queries from pcap capture files. This
software is not installed by default with BIND.
* When loading a signed zone, named will now check whether an RRSIG's
inception time is in the future, and if so, it will regenerate the RRSIG
immediately. This helps when a system's clock needs to be
reset backwards.
Feature Changes
* Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
L.ROOT-SERVERS.NET.
* The default preferred glue is now the address type of the transport the
query was received over.
* On machines with 2 or more processors (CPU), the default value for the
number of UDP listeners has been changed to the number of
detected processors minus one.
* Zone transfers now use smaller message sizes to improve message
compression. This results in reduced network usage.
* named -V output now also includes operating system details.
Porting Changes
* The Microsoft Windows install tool BINDInstall.exe which requires a
non-free version of Visual Studio to be built, now uses two files (lists of
flags and files) created by the Configure perl script
with all the needed information which were previously compiled in the
binary. Read win32utils/build.txt for more details. [RT #38915]
Bug Fixes
* rndc flushtree now works even if there wasn't a cached node at the
specified name. [RT #41846]
* Don't emit records with zero TTL unless the records were received with a
zero TTL. After being returned to waiting clients, the
answer will be discarded from the cache. [RT #41687]
* For Windows platforms, the SIT (Source Identity Token) support was
restored. (It was mistakenly partially replaced in a previous beta
with new 9.11 COOKIE support.) [RT #41905]
* When deleting records from a zone database, interior nodes could be left
empty but not deleted, damaging search performance afterward.
[RT #40997] [RT #41941]
* The server could crash due to a use-after-free if a zone transfer
timed out. [RT #41297]
* Authoritative servers that were marked as bogus (e.g. blackholed in
configuration or with invalid addresses) were being queried anyway.
[RT #41321]
* Some of the options for GeoIP ACLs, including "areacode",
"metrocode", and "timezone", were incorrectly documented as
"area","metro" and "tz". Both the long and abbreviated versions are now
accepted.
* Zones configured to use map format master files can't be used as
policy zones because RPZ summary data isn't compiled when such
zones are mapped into memory. This limitation may be fixed in a
future release, but in the meantime it has been documented, and
attempting to use such zones in response-policy statements is now a
configuration error. [RT #38321]
** Affects: bind9 (Ubuntu)
Importance: Undecided
Status: New
** Tags: bot-stop-nagging upgrade-software-version
** Description changed:
An important stable version has been released a while back. But Debian
has not packaged it yet. Please do. ftp://ftp.isc.org/isc/bind9/9.10.4
/RELEASE-NOTES-bind-9.10.4.txt
-
Security Fixes
- * Duplicate EDNS COOKIE options in a response could trigger an
- assertion failure. This flaw is disclosed in CVE-2016-2088. [RT
- #41809]
- * The resolver could abort with an assertion failure due to improper
- DNAME handling when parsing fetch reply messages. This flaw is
- disclosed in CVE-2016-1286. [RT #41753]
- * Malformed control messages can trigger assertions in named and
- rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
- * Certain errors that could be encountered when printing out or
- logging an OPT record containing a CLIENT-SUBNET option could be
- mishandled, resulting in an assertion failure. This flaw is
- disclosed in CVE-2015-8705. [RT #41397]
- * Specific APL data could trigger an INSIST. This flaw is disclosed
- in CVE-2015-8704. [RT #41396]
- * Incorrect reference counting could result in an INSIST failure if a
- socket error occurred while performing a lookup. This flaw is
- disclosed in CVE-2015-8461. [RT#40945]
- * Insufficient testing when parsing a message allowed records with an
- incorrect class to be be accepted, triggering a REQUIRE failure
- when those records were subsequently cached. This flaw is disclosed
- in CVE-2015-8000. [RT #40987]
+ * Duplicate EDNS COOKIE options in a response could trigger an
+ assertion failure. This flaw is disclosed in CVE-2016-2088. [RT
+ #41809]
+ * The resolver could abort with an assertion failure due to improper
DNAME handling when parsing fetch reply messages. This flaw is disclosed in
CVE-2016-1286. [RT #41753]
+ * Malformed control messages can trigger assertions in named and
+ rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
+ * Certain errors that could be encountered when printing out or
+ logging an OPT record containing a CLIENT-SUBNET option could be
mishandled, resulting in an assertion failure. This flaw is
+ disclosed in CVE-2015-8705. [RT #41397]
+ * Specific APL data could trigger an INSIST. This flaw is disclosed in
CVE-2015-8704. [RT #41396]
+ * Incorrect reference counting could result in an INSIST failure if a
socket error occurred while performing a lookup. This flaw is
+ disclosed in CVE-2015-8461. [RT#40945]
+ * Insufficient testing when parsing a message allowed records with an
incorrect class to be be accepted, triggering a REQUIRE failure when those
records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT
#40987]
New Features
- * The following resource record types have been implemented: AVC,
- CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
- * Added a warning for a common misconfiguration involving forwarded
- RFC 1918 and IPv6 ULA (Universal Local Address) zones.
- * Contributed software from Nominum is included in the source at
- contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the
- performance of authoritative DNS servers, resperf for testing the
- resolution performance of a caching DNS server, resperf-report for
- generating a resperf report in HTML with gnuplot graphs, and
- queryparse to extract DNS queries from pcap capture files. This
- software is not installed by default with BIND.
- * When loading a signed zone, named will now check whether an RRSIG's
- inception time is in the future, and if so, it will regenerate the
- RRSIG immediately. This helps when a system's clock needs to be
- reset backwards.
+ * The following resource record types have been implemented: AVC,
+ CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
+ * Added a warning for a common misconfiguration involving forwarded RFC
1918 and IPv6 ULA (Universal Local Address) zones.
+ * Contributed software from Nominum is included in the source at
+ contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the
performance of authoritative DNS servers, resperf for testing the
+ resolution performance of a caching DNS server, resperf-report for
generating a resperf report in HTML with gnuplot graphs, and
+ queryparse to extract DNS queries from pcap capture files. This
+ software is not installed by default with BIND.
+ * When loading a signed zone, named will now check whether an RRSIG's
+ inception time is in the future, and if so, it will regenerate the
RRSIG immediately. This helps when a system's clock needs to be
+ reset backwards.
Feature Changes
- * Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
- L.ROOT-SERVERS.NET.
- * The default preferred glue is now the address type of the transport
- the query was received over.
- * On machines with 2 or more processors (CPU), the default value for
- the number of UDP listeners has been changed to the number of
- detected processors minus one.
- * Zone transfers now use smaller message sizes to improve message
- compression. This results in reduced network usage.
- * named -V output now also includes operating system details.
+ * Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
+ L.ROOT-SERVERS.NET.
+ * The default preferred glue is now the address type of the transport
the query was received over.
+ * On machines with 2 or more processors (CPU), the default value for the
number of UDP listeners has been changed to the number of
+ detected processors minus one.
+ * Zone transfers now use smaller message sizes to improve message
+ compression. This results in reduced network usage.
+ * named -V output now also includes operating system details.
Porting Changes
- * The Microsoft Windows install tool BINDInstall.exe which requires a
- non-free version of Visual Studio to be built, now uses two files
- (lists of flags and files) created by the Configure perl script
- with all the needed information which were previously compiled in
- the binary. Read win32utils/build.txt for more details. [RT #38915]
+ * The Microsoft Windows install tool BINDInstall.exe which requires a
non-free version of Visual Studio to be built, now uses two files (lists of
flags and files) created by the Configure perl script
+ with all the needed information which were previously compiled in the
binary. Read win32utils/build.txt for more details. [RT #38915]
Bug Fixes
- * rndc flushtree now works even if there wasn't a cached node at the
- specified name. [RT #41846]
- * Don't emit records with zero TTL unless the records were received
- with a zero TTL. After being returned to waiting clients, the
- answer will be discarded from the cache. [RT #41687]
- * For Windows platforms, the SIT (Source Identity Token) support was
- restored. (It was mistakenly partially replaced in a previous beta
- with new 9.11 COOKIE support.) [RT #41905]
- * When deleting records from a zone database, interior nodes could be
- left empty but not deleted, damaging search performance afterward.
- [RT #40997] [RT #41941]
- * The server could crash due to a use-after-free if a zone transfer
- timed out. [RT #41297]
- * Authoritative servers that were marked as bogus (e.g. blackholed in
- configuration or with invalid addresses) were being queried anyway.
- [RT #41321]
- * Some of the options for GeoIP ACLs, including "areacode",
- "metrocode", and "timezone", were incorrectly documented as "area",
- "metro" and "tz". Both the long and abbreviated versions are now
- accepted.
- * Zones configured to use map format master files can't be used as
- policy zones because RPZ summary data isn't compiled when such
- zones are mapped into memory. This limitation may be fixed in a
- future release, but in the meantime it has been documented, and
- attempting to use such zones in response-policy statements is now a
- configuration error. [RT #38321]
+ * rndc flushtree now works even if there wasn't a cached node at the
specified name. [RT #41846]
+ * Don't emit records with zero TTL unless the records were received with
a zero TTL. After being returned to waiting clients, the
+ answer will be discarded from the cache. [RT #41687]
+ * For Windows platforms, the SIT (Source Identity Token) support was
restored. (It was mistakenly partially replaced in a previous beta
+ with new 9.11 COOKIE support.) [RT #41905]
+ * When deleting records from a zone database, interior nodes could be
left empty but not deleted, damaging search performance afterward.
+ [RT #40997] [RT #41941]
+ * The server could crash due to a use-after-free if a zone transfer
+ timed out. [RT #41297]
+ * Authoritative servers that were marked as bogus (e.g. blackholed in
configuration or with invalid addresses) were being queried anyway.
+ [RT #41321]
+ * Some of the options for GeoIP ACLs, including "areacode",
+ "metrocode", and "timezone", were incorrectly documented as
"area","metro" and "tz". Both the long and abbreviated versions are now
+ accepted.
+ * Zones configured to use map format master files can't be used as
+ policy zones because RPZ summary data isn't compiled when such
+ zones are mapped into memory. This limitation may be fixed in a
+ future release, but in the meantime it has been documented, and
+ attempting to use such zones in response-policy statements is now a
configuration error. [RT #38321]
** Tags added: bot-stop-nagging upgrade-software-version
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1606828
Title:
[Security Fixes] BIND Stable Version 9.10.4
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1606828/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
