Waiting for BIND security announcement

[Jeffrey Goldberg]

On Jul 31, 2007, at 10:05 PM, A.G. Russell IV wrote:

>> On Thu, Jul 26, 2007 at 10:48:10AM +0200, Zbigniew Szalbot wrote:
>>>> On 7/25/07, Doug Barton <dougb at freebsd.org> wrote:
>>>>
>>>>> RELENG_6 was updated shortly after the release of 9.3.4. I'll be
>>>>> updating RELENG_[56] with the new 9.3.4-P1 version after I'm done
>>>>> regression testing it, which should be some time tonight. Same for
>>>>> updating HEAD with 9.4.1-P1.

>>>>> I am running FreeBSD 6.2-RELEASE-p6 and BIND 9.3.3 (not from  
>>>>> ports but
>>> installed with the system. At least when I do pgk_info -Ix bind I  
>>> am told
>>> there is no such package installed). Where can I find information  
>>> on BIND
>>> upgrade? I tried freebsd-update but it did not think I needed any  
>>> updates
>>> :)


>  mine, which was updated a few minutes ago, is still at bind 9.3.3

It appears that BIND has only been fixed in -STABLE and -CURRENT, but  
not in -RELEASE.  Does anyone know if there are plans to get this  
patched in 6.2?

For me it makes little difference since I am not (yet) running named  
in a publicly accessible way.  But my medium term plans for my DNS do  
involve me running a public nameserver on the latest RELEASE with all  
patches.

It does worry me if this kind of thing doesn't get patched in the  
latest RELEASE.

-j



-- 
Jeffrey Goldberg                        http://www.goldmark.org/jeff/