What about BIND 9.3.4 in FreeBSD in base system ?

[Doug Barton]

Chuck Swiger wrote:
> Doug Barton wrote:
>> Chris Marlatt wrote:
> [ ... ]
>> Yes, but whether a full upgrade is needed for "support" or not depends 
>> on your definition. Given that FreeBSD is not vulnerable to these 
>> issues in its default configuration, one could easily argue that an 
>> upgrade for RELENG_5 isn't necessary.
> 
> I've been bitten by CVE-2006-4096, and have applied the workaround to 
> limit the # of outstanding queries.

I have no doubt that users who have active name servers in a 
production environment _will_ need to update their name servers to the 
latest and greatest versions. The ports exist in part to facilitate 
using the latest BIND on older versions of FreeBSD that will not be 
updated. You can even use the option to have the ports overwrite what 
is in your base system if that is important to you. (I developed that 
capability precisely because at the time I was using the ports to 
upgrade BIND on older systems.)

> I've got two nameservers tracking 5-STABLE

I am not sure how to respond to that. Many people much more 
knowledgeable than I have said that production services should be 
migrated to RELENG_6. I personally don't have any RELENG_5 systems 
anymore, and don't plan to get any, which means that the build will be 
untested on those platforms. It's unlikely that there will be any 
problems, but not impossible.

That said, let me reiterate the point above. The ports exist for users 
who need to run specific versions of BIND on older FreeBSD systems. 
The way named is installed and configured _by default_ on FreeBSD, it 
is not vulnerable to any of these issues unless you allow untrusted 
users to access the local machine.

> I'm starting to feel thankful that my important domains include off-site 
> secondaries which are running djbdns.

EGRATUITOUSBINDBASHING

> Does the FreeBSD security team have a position with regard to whether 
> the above DoS vulnerabilities ought to be fixed in the 5-STABLE branch?

They are actually reviewing the issue as we speak. As I've said, I'll 
abide by the secteam's request either way, I am simply stating a 
preference.

Doug

-- 

     This .signature sanitized for your protection