Chuck Swiger wrote:
Doug Barton wrote:
Chris Marlatt wrote:
[ ... ]
Yes, but whether a full upgrade is needed for "support" or not depends
on your definition. Given that FreeBSD is not vulnerable to these
issues in its default configuration, one could easily argue that an
upgrade for RELENG_5 isn't necessary.
I've been bitten by CVE-2006-4096, and have applied the workaround to
limit the # of outstanding queries.
I have no doubt that users who have active name servers in a
production environment _will_ need to update their name servers to the
latest and greatest versions. The ports exist in part to facilitate
using the latest BIND on older versions of FreeBSD that will not be
updated. You can even use the option to have the ports overwrite what
is in your base system if that is important to you. (I developed that
capability precisely because at the time I was using the ports to
upgrade BIND on older systems.)
I've got two nameservers tracking 5-STABLE
I am not sure how to respond to that. Many people much more
knowledgeable than I have said that production services should be
migrated to RELENG_6. I personally don't have any RELENG_5 systems
anymore, and don't plan to get any, which means that the build will be
untested on those platforms. It's unlikely that there will be any
problems, but not impossible.
That said, let me reiterate the point above. The ports exist for users
who need to run specific versions of BIND on older FreeBSD systems.
The way named is installed and configured _by default_ on FreeBSD, it
is not vulnerable to any of these issues unless you allow untrusted
users to access the local machine.
I'm starting to feel thankful that my important domains include off-site
secondaries which are running djbdns.
EGRATUITOUSBINDBASHING
Does the FreeBSD security team have a position with regard to whether
the above DoS vulnerabilities ought to be fixed in the 5-STABLE branch?
They are actually reviewing the issue as we speak. As I've said, I'll
abide by the secteam's request either way, I am simply stating a
preference.
Doug
--
This .signature sanitized for your protection
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
