external/bsd/bind/dist/doc/arm/notes.html

   1 <!--
   2  -
   3  - Permission to use, copy, modify, and/or distribute this software for any
   4  - purpose with or without fee is hereby granted, provided that the above
   5  - copyright notice and this permission notice appear in all copies.
   6  -
   7  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
   8  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
   9  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  10  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  11  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  12  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  13  - PERFORMANCE OF THIS SOFTWARE.
  14 -->
  15 <!-- Id -->
  16 <html>
  17 <head>
  18 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
  19 <title></title>
  20 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
  21 </head>
  22 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="sect1" lang="en">
  23 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
  24 <a name="id2542126"></a>Release Notes for BIND Version 9.10.2-P4</h2></div></div></div>
  25 <div class="sect2" lang="en">
  26 <div class="titlepage"><div><div><h3 class="title">
  27 <a name="relnotes_intro"></a>Introduction</h3></div></div></div>
  28 <p>
  29       This document summarizes changes since BIND 9.10.2:
  30     </p>
  31 <p>
  32       BIND 9.10.2-P4 addresses security issues described in
  33       CVE-2015-5722 and CVE-2015-5986.
  34     </p>
  35 <p>
  36       BIND 9.10.2-P3 addresses a security issue described in
  37       CVE-2015-5477.
  38     </p>
  39 <p>
  40       BIND 9.10.2-P2 addresses a security issue described in
  41       CVE-2015-4620.
  42     </p>
  43 <p>
  44       BIND 9.10.2-P1 addressed several bugs that have been identified
  45       in the BIND 9.10 implementation of response-policy zones (RPZ).
  46       The bugs are in code which optimizes searching through multiple
  47       policy zones. In some cases, they can cause RPZ to behave
  48       inefficiently by searching for query matches in more policy
  49       zones than are strictly necessary, or to behave unpredictably
  50       by failing to search a policy zone that should have been
  51       searched.  In the worst case, they can lead to assertion
  52       failures, terminating <span><strong class="command">named</strong></span>.
  53     </p>
  54 </div>
  55 <div class="sect2" lang="en">
  56 <div class="titlepage"><div><div><h3 class="title">
  57 <a name="relnotes_download"></a>Download</h3></div></div></div>
  58 <p>
  59       The latest versions of BIND 9 software can always be found at
  60       <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
  61       There you will find additional information about each release,
  62       source code, and pre-compiled versions for Microsoft Windows
  63       operating systems.
  64     </p>
  65 </div>
  66 <div class="sect2" lang="en">
  67 <div class="titlepage"><div><div><h3 class="title">
  68 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
  69 <div class="itemizedlist"><ul type="disc">
  70 <li><p>
  71           An incorrect boundary check in the OPENPGPKEY rdatatype
  72           could trigger an assertion failure. This flaw is disclosed
  73           in CVE-2015-5986. [RT #40286]
  74         </p></li>
  75 <li>
  76 <p>
  77           A buffer accounting error could trigger an assertion failure
  78           when parsing certain malformed DNSSEC keys.
  79         </p>
  80 <p>
  81           This flaw was discovered by Hanno B&#50102;eck of the Fuzzing
  82           Project, and is disclosed in CVE-2015-5722. [RT #40212]
  83         </p>
  84 </li>
  85 <li>
  86 <p>
  87           A specially crafted query could trigger an assertion failure
  88           in message.c.
  89         </p>
  90 <p>
  91           This flaw was discovered by Jonathan Foote, and is disclosed
  92           in CVE-2015-5477. [RT #39795]
  93         </p>
  94 </li>
  95 <li>
  96 <p>
  97           On servers configured to perform DNSSEC validation, an
  98           assertion failure could be triggered on answers from
  99           a specially configured server.
 100         </p>
 101 <p>
 102           This flaw was discovered by Breno Silveira Soares, and is
 103           disclosed in CVE-2015-4620. [RT #39795]
 104         </p>
 105 </li>
 106 </ul></div>
 107 </div>
 108 <div class="sect2" lang="en">
 109 <div class="titlepage"><div><div><h3 class="title">
 110 <a name="relnotes_features"></a>New Features</h3></div></div></div>
 111 <div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
 112 </div>
 113 <div class="sect2" lang="en">
 114 <div class="titlepage"><div><div><h3 class="title">
 115 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
 116 <div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
 117 </div>
 118 <div class="sect2" lang="en">
 119 <div class="titlepage"><div><div><h3 class="title">
 120 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
 121 <div class="itemizedlist"><ul type="disc">
 122 <li><p>
 123           Asynchronous zone loads were not handled correctly when the
 124           zone load was already in progress; this could trigger a crash
 125           in zt.c. [RT #37573]
 126         </p></li>
 127 <li>
 128 <p>
 129           Several bugs have been fixed in the RPZ implementation:
 130         </p>
 131 <div class="itemizedlist"><ul type="circle">
 132 <li><p>
 133               Policy zones that did not specifically require recursion
 134               could be treated as if they did; consequently, setting
 135               <span><strong class="command">qname-wait-recurse no;</strong></span> was
 136               sometimes ineffective.  This has been corrected.
 137               In most configurations, behavioral changes due to this
 138               fix will not be noticeable. [RT #39229]
 139             </p></li>
 140 <li><p>
 141               The server could crash if policy zones were updated (e.g.
 142               via <span><strong class="command">rndc reload</strong></span> or an incoming zone
 143               transfer) while RPZ processing was still ongoing for an
 144               active query. [RT #39415]
 145             </p></li>
 146 <li><p>
 147               On servers with one or more policy zones configured as
 148               slaves, if a policy zone updated during regular operation
 149               (rather than at startup) using a full zone reload, such as
 150               via AXFR, a bug could allow the RPZ summary data to fall out
 151               of sync, potentially leading to an assertion failure in
 152               rpz.c when further incremental updates were made to the
 153               zone, such as via IXFR. [RT #39567]
 154             </p></li>
 155 <li><p>
 156               The server could match a shorter prefix than what was
 157               available in CLIENT-IP policy triggers, and so, an
 158               unexpected action could be taken. This has been
 159               corrected. [RT #39481]
 160             </p></li>
 161 <li><p>
 162               The server could crash if a reload of an RPZ zone was
 163               initiated while another reload of the same zone was
 164               already in progress. [RT #39649]
 165             </p></li>
 166 </ul></div>
 167 </li>
 168 </ul></div>
 169 </div>
 170 <div class="sect2" lang="en">
 171 <div class="titlepage"><div><div><h3 class="title">
 172 <a name="end_of_life"></a>End of Life</h3></div></div></div>
 173 <p>
 174       The end of life for BIND 9.10 is yet to be determined but
 175       will not be before BIND 9.12.0 has been released for 6 months.
 176       <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
 177     </p>
 178 </div>
 179 <div class="sect2" lang="en">
 180 <div class="titlepage"><div><div><h3 class="title">
 181 <a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
 182 <p>
 183       Thank you to everyone who assisted us in making this release possible.
 184       If you would like to contribute to ISC to assist us in continuing to
 185       make quality open source software, please visit our donations page at
 186       <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
 187     </p>
 188 </div>
 189 </div></div></body>
 190 </html>