diff options
| author | dougb <dougb@FreeBSD.org> | 2011-11-17 00:25:35 +0000 |
|---|---|---|
| committer | dougb <dougb@FreeBSD.org> | 2011-11-17 00:25:35 +0000 |
| commit | 446da3721f45347b47bb08332a2da8bc00b2a590 (patch) | |
| tree | aa4de14f8e91fd75c927a2e03a501d1904ea5da0 /contrib/bind9/lib | |
| parent | 8e6c6b9b26e1b51e56ccbe3ff7d741ab0bcca9a6 (diff) | |
| download | FreeBSD-src-446da3721f45347b47bb08332a2da8bc00b2a590.zip FreeBSD-src-446da3721f45347b47bb08332a2da8bc00b2a590.tar.gz | |
Upgrade to BIND 9.8.1-P1 to address the following DDOS bug:
Recursive name servers are failing with an assertion:
INSIST(! dns_rdataset_isassociated(sigrdataset))
At this time it is not thought that authoritative-only servers
are affected, but information about this bug is evolving rapidly.
Because it may be possible to trigger this bug even on networks
that do not allow untrusted users to access the recursive name
servers (perhaps via specially crafted e-mail messages, and/or
malicious web sites) it is recommended that ALL operators of
recursive name servers upgrade immediately.
For more information see:
https://www.isc.org/software/bind/advisories/cve-2011-tbd
which will be updated as more information becomes available.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313
Diffstat (limited to 'contrib/bind9/lib')
| -rw-r--r-- | contrib/bind9/lib/dns/rbtdb.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/contrib/bind9/lib/dns/rbtdb.c b/contrib/bind9/lib/dns/rbtdb.c index 9d66006..10525d9 100644 --- a/contrib/bind9/lib/dns/rbtdb.c +++ b/contrib/bind9/lib/dns/rbtdb.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rbtdb.c,v 1.310.8.5 2011-06-08 23:02:42 each Exp $ */ +/* $Id: rbtdb.c,v 1.310.8.5.4.1 2011-11-16 09:32:08 marka Exp $ */ /*! \file */ @@ -5053,7 +5053,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, rdataset); if (need_headerupdate(found, search.now)) update = found; - if (foundsig != NULL) { + if (!NEGATIVE(found) && foundsig != NULL) { bind_rdataset(search.rbtdb, node, foundsig, search.now, sigrdataset); if (need_headerupdate(foundsig, search.now)) @@ -5685,7 +5685,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, } if (found != NULL) { bind_rdataset(rbtdb, rbtnode, found, now, rdataset); - if (foundsig != NULL) + if (!NEGATIVE(found) && foundsig != NULL) bind_rdataset(rbtdb, rbtnode, foundsig, now, sigrdataset); } |
