Re: What about BIND 9.3.4 in FreeBSD in base system ?

Chuck Swiger wrote:
Doug Barton wrote:
Chris Marlatt wrote:
[ ... ]
Yes, but whether a full upgrade is needed for "support" or not depends on your definition. Given that FreeBSD is not vulnerable to these issues in its default configuration, one could easily argue that an upgrade for RELENG_5 isn't necessary.

I've been bitten by CVE-2006-4096, and have applied the workaround to limit the # of outstanding queries.

I have no doubt that users who have active name servers in a production environment _will_ need to update their name servers to the latest and greatest versions. The ports exist in part to facilitate using the latest BIND on older versions of FreeBSD that will not be updated. You can even use the option to have the ports overwrite what is in your base system if that is important to you. (I developed that capability precisely because at the time I was using the ports to upgrade BIND on older systems.)

I've got two nameservers tracking 5-STABLE

I am not sure how to respond to that. Many people much more knowledgeable than I have said that production services should be migrated to RELENG_6. I personally don't have any RELENG_5 systems anymore, and don't plan to get any, which means that the build will be untested on those platforms. It's unlikely that there will be any problems, but not impossible.

That said, let me reiterate the point above. The ports exist for users who need to run specific versions of BIND on older FreeBSD systems. The way named is installed and configured _by default_ on FreeBSD, it is not vulnerable to any of these issues unless you allow untrusted users to access the local machine.

I'm starting to feel thankful that my important domains include off-site secondaries which are running djbdns.

EGRATUITOUSBINDBASHING

Does the FreeBSD security team have a position with regard to whether the above DoS vulnerabilities ought to be fixed in the 5-STABLE branch?

They are actually reviewing the issue as we speak. As I've said, I'll abide by the secteam's request either way, I am simply stating a preference.

Doug

--

This .signature sanitized for your protection

_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages