id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
6161	bind-9.10.1-P2 and BIND Utilities-9.10.1-P2	Fernando de Oliveira	bdubbs@…	"[ftp://ftp.isc.org/isc/bind9/9.10.1-P2/bind-9.10.1-P2.tar.gz]

[ftp://ftp.isc.org/isc/bind9/9.10.1-P2/RELEASE-NOTES-BIND-9.10.1-P2.txt]

{{{
Security Fixes

   On servers configured to perform DNSSEC validation using managed
   trust anchors (i.e., keys configured explicitly via managed-keys, or
   implicitly via dnssec-validation auto; or dnssec-lookaside auto;),
   revoking a trust anchor and sending a new untrusted replacement could
   cause named to crash with an assertion failure.  This could occur in
   the event of a botched key rollover, or potentially as a result of a
   deliberate attack if the attacker was in position to monitor the
   victim's DNS traffic.  This flaw was discovered by Jan-Piet Mens, and
   is disclosed in [CVE-2015-1349] [RT #38344] (**)

   A flaw in delegation handling could be exploited to put named
   into an infinite loop, in which each lookup of a name server
   triggered additional lookups of more name servers.  This has
   been addressed by placing limits on the number of levels of
   recursion named will allow (default 7), and on the number of
   queries that it will send before terminating a recursive query
   (default 50).  The recursion depth limit is configured via the
   max-recursion-depth option, and the query limit via the
   max-recursion-queries option.  The flaw was discovered by
   Florian Maury of ANSSI [CVE-2014-8500] [RT #37580]

   Two separate problems were identified in BIND's GeoIP code that
   could lead to an assertion failure. One was triggered by use of
   both IPv4 and IPv6 address families, the other by referencing a
   GeoIP database in named.conf which was not installed. Both are
   covered by CVE-2014-8680. [RT #37672] [RT #37679]

   A less serious security flaw was also found in GeoIP: changes
   to the geoip-directory option in named.conf were ignored when
   running rndc reconfig. In theory, this could allow named to allow
   access to unintended clients.

   A query specially crafted to exploit a defect in EDNS option
   processing could cause named to terminate with an assertion
   failure, due to a missing isc_buffer_availablelength() check
   when formatting packet contents for logging. For more information,
   see the security advisory at https://kb.isc.org/article/AA-01166/.
   [CVE-2014-3859] [RT #36078]

   A programming error in the prefetch feature could cause named
   to crash with a ""REQUIRE"" assertion failure in name.c. For more
   information, see the security advisory at
   https://kb.isc.org/article/AA-01161/. [CVE-2014-3214] [RT #35899]

New Features

   ...

Feature Changes

   ...

Bug Fixes

   ...

}}}
"	enhancement	closed	high	7.7	BOOK	SVN	medium	fixed