1<!-- 2 - 3 - Permission to use, copy, modify, and/or distribute this software for any 4 - purpose with or without fee is hereby granted, provided that the above 5 - copyright notice and this permission notice appear in all copies. 6 - 7 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 8 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 9 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 10 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 11 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 12 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 13 - PERFORMANCE OF THIS SOFTWARE. 14--> 15<!-- Id --> 16<html> 17<head> 18<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 19<title></title> 20<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> 21</head> 22<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="sect1" lang="en"> 23<div class="titlepage"><div><div><h2 class="title" style="clear: both"> 24<a name="id2542126"></a>Release Notes for BIND Version 9.10.2-P4</h2></div></div></div> 25<div class="sect2" lang="en"> 26<div class="titlepage"><div><div><h3 class="title"> 27<a name="relnotes_intro"></a>Introduction</h3></div></div></div> 28<p> 29 This document summarizes changes since BIND 9.10.2: 30 </p> 31<p> 32 BIND 9.10.2-P4 addresses security issues described in 33 CVE-2015-5722 and CVE-2015-5986. 34 </p> 35<p> 36 BIND 9.10.2-P3 addresses a security issue described in 37 CVE-2015-5477. 38 </p> 39<p> 40 BIND 9.10.2-P2 addresses a security issue described in 41 CVE-2015-4620. 42 </p> 43<p> 44 BIND 9.10.2-P1 addressed several bugs that have been identified 45 in the BIND 9.10 implementation of response-policy zones (RPZ). 46 The bugs are in code which optimizes searching through multiple 47 policy zones. In some cases, they can cause RPZ to behave 48 inefficiently by searching for query matches in more policy 49 zones than are strictly necessary, or to behave unpredictably 50 by failing to search a policy zone that should have been 51 searched. In the worst case, they can lead to assertion 52 failures, terminating <span><strong class="command">named</strong></span>. 53 </p> 54</div> 55<div class="sect2" lang="en"> 56<div class="titlepage"><div><div><h3 class="title"> 57<a name="relnotes_download"></a>Download</h3></div></div></div> 58<p> 59 The latest versions of BIND 9 software can always be found at 60 <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>. 61 There you will find additional information about each release, 62 source code, and pre-compiled versions for Microsoft Windows 63 operating systems. 64 </p> 65</div> 66<div class="sect2" lang="en"> 67<div class="titlepage"><div><div><h3 class="title"> 68<a name="relnotes_security"></a>Security Fixes</h3></div></div></div> 69<div class="itemizedlist"><ul type="disc"> 70<li><p> 71 An incorrect boundary check in the OPENPGPKEY rdatatype 72 could trigger an assertion failure. This flaw is disclosed 73 in CVE-2015-5986. [RT #40286] 74 </p></li> 75<li> 76<p> 77 A buffer accounting error could trigger an assertion failure 78 when parsing certain malformed DNSSEC keys. 79 </p> 80<p> 81 This flaw was discovered by Hanno B쎶eck of the Fuzzing 82 Project, and is disclosed in CVE-2015-5722. [RT #40212] 83 </p> 84</li> 85<li> 86<p> 87 A specially crafted query could trigger an assertion failure 88 in message.c. 89 </p> 90<p> 91 This flaw was discovered by Jonathan Foote, and is disclosed 92 in CVE-2015-5477. [RT #39795] 93 </p> 94</li> 95<li> 96<p> 97 On servers configured to perform DNSSEC validation, an 98 assertion failure could be triggered on answers from 99 a specially configured server. 100 </p> 101<p> 102 This flaw was discovered by Breno Silveira Soares, and is 103 disclosed in CVE-2015-4620. [RT #39795] 104 </p> 105</li> 106</ul></div> 107</div> 108<div class="sect2" lang="en"> 109<div class="titlepage"><div><div><h3 class="title"> 110<a name="relnotes_features"></a>New Features</h3></div></div></div> 111<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div> 112</div> 113<div class="sect2" lang="en"> 114<div class="titlepage"><div><div><h3 class="title"> 115<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div> 116<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div> 117</div> 118<div class="sect2" lang="en"> 119<div class="titlepage"><div><div><h3 class="title"> 120<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div> 121<div class="itemizedlist"><ul type="disc"> 122<li><p> 123 Asynchronous zone loads were not handled correctly when the 124 zone load was already in progress; this could trigger a crash 125 in zt.c. [RT #37573] 126 </p></li> 127<li> 128<p> 129 Several bugs have been fixed in the RPZ implementation: 130 </p> 131<div class="itemizedlist"><ul type="circle"> 132<li><p> 133 Policy zones that did not specifically require recursion 134 could be treated as if they did; consequently, setting 135 <span><strong class="command">qname-wait-recurse no;</strong></span> was 136 sometimes ineffective. This has been corrected. 137 In most configurations, behavioral changes due to this 138 fix will not be noticeable. [RT #39229] 139 </p></li> 140<li><p> 141 The server could crash if policy zones were updated (e.g. 142 via <span><strong class="command">rndc reload</strong></span> or an incoming zone 143 transfer) while RPZ processing was still ongoing for an 144 active query. [RT #39415] 145 </p></li> 146<li><p> 147 On servers with one or more policy zones configured as 148 slaves, if a policy zone updated during regular operation 149 (rather than at startup) using a full zone reload, such as 150 via AXFR, a bug could allow the RPZ summary data to fall out 151 of sync, potentially leading to an assertion failure in 152 rpz.c when further incremental updates were made to the 153 zone, such as via IXFR. [RT #39567] 154 </p></li> 155<li><p> 156 The server could match a shorter prefix than what was 157 available in CLIENT-IP policy triggers, and so, an 158 unexpected action could be taken. This has been 159 corrected. [RT #39481] 160 </p></li> 161<li><p> 162 The server could crash if a reload of an RPZ zone was 163 initiated while another reload of the same zone was 164 already in progress. [RT #39649] 165 </p></li> 166</ul></div> 167</li> 168</ul></div> 169</div> 170<div class="sect2" lang="en"> 171<div class="titlepage"><div><div><h3 class="title"> 172<a name="end_of_life"></a>End of Life</h3></div></div></div> 173<p> 174 The end of life for BIND 9.10 is yet to be determined but 175 will not be before BIND 9.12.0 has been released for 6 months. 176 <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a> 177 </p> 178</div> 179<div class="sect2" lang="en"> 180<div class="titlepage"><div><div><h3 class="title"> 181<a name="relnotes_thanks"></a>Thank You</h3></div></div></div> 182<p> 183 Thank you to everyone who assisted us in making this release possible. 184 If you would like to contribute to ISC to assist us in continuing to 185 make quality open source software, please visit our donations page at 186 <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>. 187 </p> 188</div> 189</div></div></body> 190</html> 191