bind9 bind 9.20.20

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Release notes:

Notes for BIND 9.20.20
Security Fixes

    Fix a use-after-free error in dns_client_resolve() triggered by a DNAME response.

    This issue only affected the delv tool and it has now been fixed.

    ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our 
attention. [GL #5728]

Feature Changes

    Record query time for all dnstap responses.

    Not all DNS responses had the query time set in their corresponding dnstap messages. 
This has been fixed. [GL #3695]

    Optimize TCP source port selection on Linux.

    Enable the IP_LOCAL_PORT_RANGE socket option on the outgoing TCP sockets to allow 
faster selection of the source <address,port> tuple for different destination 
<address,port> tuples, when nearing over 70-80% of the source port utilization. [GL !
11569]

Bug Fixes

    Fix an assertion failure triggered by non-minimal IXFRs.

    Processing an IXFR that included an RRset whose contents were not changed by the 
transfer triggered an assertion failure. This has been fixed. [GL #5759]

    Fix a crash when retrying a NOTIFY over TCP.

    Furthermore, do not attempt to retry over TCP at all if the source address is not 
available. [GL #5457]

    Fetch loop detection improvements.

    Fix a case where an in-domain nameserver with expired glue would fail to resolve. 
[GL #5588]

    Randomize nameserver selection.

    Since BIND 9.20.17, when selecting nameserver addresses to be looked up, named 
selected them in DNSSEC order from the start of the NS RRset. This could lead to a 
resolution failure despite there being an address that could be resolved using the other 
nameserver names. named now randomizes the order in which nameserver addresses are 
looked up. [GL #5695] [GL #5745]

    Fix dnstap logging of forwarded queries. [GL #5724]

    A stale answer could have been served in case of multiple upstream failures when 
following CNAME chains. This has been fixed. [GL #5751]

    Fail DNSKEY validation when supported but invalid DS is found.

    A regression was introduced in BIND 9.20.6 when adding the EDE code for unsupported 
DNSKEY and DS algorithms. When the parent had both supported and unsupported algorithms 
in the DS record, the validator would treat the supported DS algorithm as insecure 
instead of bogus when validating DNSKEY records. This has no security impact, as the 
rest of the child zone correctly ends with bogus status, but it is incorrect and thus 
the regression has been fixed. [GL #5757]

    Importing an invalid SKR file might corrupt stack memory.

    If an administrator imported an invalid SKR file, the local stack in the import 
function might overflow. This could lead to a memory corruption on the stack and 
ultimately a server crash. This has been fixed. [GL #5758]

    Return FORMERR for queries with the EDNS Client Subnet FAMILY field set to 0.

    RFC 7871 only defines families 1 (IPv4) and 2 (IPv6), and requires FORMERR to be 
returned for all unknown families. Queries with the EDNS Client Subnet FAMILY field set 
to 0 now elicit responses with RCODE=FORMERR. [GL !11565]

The security vulnerability is only a crash when using the 'delv' utility, which we don't carry in the BIND Utilities package and is likely not used much in comparison to dig. There is no CVE assigned at the moment, and the CVSS rating is Low because it requires the user to explicitly go down an unsupported codepath.

For consistency I will rate this as Elevated, but this can wait for 13.1, at least from a security perspective.

[Douglas R. Reno]

Fixed at 5a89e13d6928cf759470deefc12663f3ac1c12b9

SA-13.0-002 issued