1<!-- 2 - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") 3 - Copyright (C) 2000-2003 Internet Software Consortium. 4 - 5 - Permission to use, copy, modify, and/or distribute this software for any 6 - purpose with or without fee is hereby granted, provided that the above 7 - copyright notice and this permission notice appear in all copies. 8 - 9 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 10 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 11 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 12 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 13 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 14 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 15 - PERFORMANCE OF THIS SOFTWARE. 16--> 17<!-- $Id: Bv9ARM.ch09.html,v 1.5 2015/09/03 07:33:34 christos Exp $ --> 18<html> 19<head> 20<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 21<title>Appendix�A.�Release Notes</title> 22<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> 23<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> 24<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> 25<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting"> 26<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND"> 27</head> 28<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> 29<div class="navheader"> 30<table width="100%" summary="Navigation header"> 31<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr> 32<tr> 33<td width="20%" align="left"> 34<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td> 35<th width="60%" align="center">�</th> 36<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a> 37</td> 38</tr> 39</table> 40<hr> 41</div> 42<div class="appendix" lang="en"> 43<div class="titlepage"><div><div><h2 class="title"> 44<a name="Bv9ARM.ch09"></a>Appendix�A.�Release Notes</h2></div></div></div> 45<div class="toc"> 46<p><b>Table of Contents</b></p> 47<dl> 48<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2610666">Release Notes for BIND Version 9.10.2-P4</a></span></dt> 49<dd><dl> 50<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt> 51<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt> 52<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt> 53<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt> 54<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt> 55<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt> 56<dt><span class="sect2"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt> 57<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt> 58</dl></dd> 59</dl> 60</div> 61<div class="sect1" lang="en"> 62<div class="titlepage"><div><div><h2 class="title" style="clear: both"> 63<a name="id2610666"></a>Release Notes for BIND Version 9.10.2-P4</h2></div></div></div> 64<div class="sect2" lang="en"> 65<div class="titlepage"><div><div><h3 class="title"> 66<a name="relnotes_intro"></a>Introduction</h3></div></div></div> 67<p> 68 This document summarizes changes since BIND 9.10.2: 69 </p> 70<p> 71 BIND 9.10.2-P4 addresses security issues described in 72 CVE-2015-5722 and CVE-2015-5986. 73 </p> 74<p> 75 BIND 9.10.2-P3 addresses a security issue described in 76 CVE-2015-5477. 77 </p> 78<p> 79 BIND 9.10.2-P2 addresses a security issue described in 80 CVE-2015-4620. 81 </p> 82<p> 83 BIND 9.10.2-P1 addressed several bugs that have been identified 84 in the BIND 9.10 implementation of response-policy zones (RPZ). 85 The bugs are in code which optimizes searching through multiple 86 policy zones. In some cases, they can cause RPZ to behave 87 inefficiently by searching for query matches in more policy 88 zones than are strictly necessary, or to behave unpredictably 89 by failing to search a policy zone that should have been 90 searched. In the worst case, they can lead to assertion 91 failures, terminating <span><strong class="command">named</strong></span>. 92 </p> 93</div> 94<div class="sect2" lang="en"> 95<div class="titlepage"><div><div><h3 class="title"> 96<a name="relnotes_download"></a>Download</h3></div></div></div> 97<p> 98 The latest versions of BIND 9 software can always be found at 99 <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>. 100 There you will find additional information about each release, 101 source code, and pre-compiled versions for Microsoft Windows 102 operating systems. 103 </p> 104</div> 105<div class="sect2" lang="en"> 106<div class="titlepage"><div><div><h3 class="title"> 107<a name="relnotes_security"></a>Security Fixes</h3></div></div></div> 108<div class="itemizedlist"><ul type="disc"> 109<li><p> 110 An incorrect boundary check in the OPENPGPKEY rdatatype 111 could trigger an assertion failure. This flaw is disclosed 112 in CVE-2015-5986. [RT #40286] 113 </p></li> 114<li> 115<p> 116 A buffer accounting error could trigger an assertion failure 117 when parsing certain malformed DNSSEC keys. 118 </p> 119<p> 120 This flaw was discovered by Hanno B쎶eck of the Fuzzing 121 Project, and is disclosed in CVE-2015-5722. [RT #40212] 122 </p> 123</li> 124<li> 125<p> 126 A specially crafted query could trigger an assertion failure 127 in message.c. 128 </p> 129<p> 130 This flaw was discovered by Jonathan Foote, and is disclosed 131 in CVE-2015-5477. [RT #39795] 132 </p> 133</li> 134<li> 135<p> 136 On servers configured to perform DNSSEC validation, an 137 assertion failure could be triggered on answers from 138 a specially configured server. 139 </p> 140<p> 141 This flaw was discovered by Breno Silveira Soares, and is 142 disclosed in CVE-2015-4620. [RT #39795] 143 </p> 144</li> 145</ul></div> 146</div> 147<div class="sect2" lang="en"> 148<div class="titlepage"><div><div><h3 class="title"> 149<a name="relnotes_features"></a>New Features</h3></div></div></div> 150<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div> 151</div> 152<div class="sect2" lang="en"> 153<div class="titlepage"><div><div><h3 class="title"> 154<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div> 155<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div> 156</div> 157<div class="sect2" lang="en"> 158<div class="titlepage"><div><div><h3 class="title"> 159<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div> 160<div class="itemizedlist"><ul type="disc"> 161<li><p> 162 Asynchronous zone loads were not handled correctly when the 163 zone load was already in progress; this could trigger a crash 164 in zt.c. [RT #37573] 165 </p></li> 166<li> 167<p> 168 Several bugs have been fixed in the RPZ implementation: 169 </p> 170<div class="itemizedlist"><ul type="circle"> 171<li><p> 172 Policy zones that did not specifically require recursion 173 could be treated as if they did; consequently, setting 174 <span><strong class="command">qname-wait-recurse no;</strong></span> was 175 sometimes ineffective. This has been corrected. 176 In most configurations, behavioral changes due to this 177 fix will not be noticeable. [RT #39229] 178 </p></li> 179<li><p> 180 The server could crash if policy zones were updated (e.g. 181 via <span><strong class="command">rndc reload</strong></span> or an incoming zone 182 transfer) while RPZ processing was still ongoing for an 183 active query. [RT #39415] 184 </p></li> 185<li><p> 186 On servers with one or more policy zones configured as 187 slaves, if a policy zone updated during regular operation 188 (rather than at startup) using a full zone reload, such as 189 via AXFR, a bug could allow the RPZ summary data to fall out 190 of sync, potentially leading to an assertion failure in 191 rpz.c when further incremental updates were made to the 192 zone, such as via IXFR. [RT #39567] 193 </p></li> 194<li><p> 195 The server could match a shorter prefix than what was 196 available in CLIENT-IP policy triggers, and so, an 197 unexpected action could be taken. This has been 198 corrected. [RT #39481] 199 </p></li> 200<li><p> 201 The server could crash if a reload of an RPZ zone was 202 initiated while another reload of the same zone was 203 already in progress. [RT #39649] 204 </p></li> 205</ul></div> 206</li> 207</ul></div> 208</div> 209<div class="sect2" lang="en"> 210<div class="titlepage"><div><div><h3 class="title"> 211<a name="end_of_life"></a>End of Life</h3></div></div></div> 212<p> 213 The end of life for BIND 9.10 is yet to be determined but 214 will not be before BIND 9.12.0 has been released for 6 months. 215 <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a> 216 </p> 217</div> 218<div class="sect2" lang="en"> 219<div class="titlepage"><div><div><h3 class="title"> 220<a name="relnotes_thanks"></a>Thank You</h3></div></div></div> 221<p> 222 Thank you to everyone who assisted us in making this release possible. 223 If you would like to contribute to ISC to assist us in continuing to 224 make quality open source software, please visit our donations page at 225 <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>. 226 </p> 227</div> 228</div> 229</div> 230<div class="navfooter"> 231<hr> 232<table width="100%" summary="Navigation footer"> 233<tr> 234<td width="40%" align="left"> 235<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td> 236<td width="20%" align="center">�</td> 237<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a> 238</td> 239</tr> 240<tr> 241<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td> 242<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> 243<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> 244</td> 245</tr> 246</table> 247</div> 248<p style="text-align: center;">BIND 9.10.2-P4</p> 249</body> 250</html> 251