From: Mark Andrews Date: Thu, 16 Jun 2011 01:32:43 +0000 (+0000) Subject: update for re-tag of 9.6-ESV-R5rc1 X-Git-Tag: v9.6-ESV-R5rc1~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=29b2abbbb4a38abc1b5a0a89db52acc6fec3444a;p=thirdparty%2Fbind9.git update for re-tag of 9.6-ESV-R5rc1 --- diff --git a/RELEASE-NOTES-BIND-9.6-ESV.html b/RELEASE-NOTES-BIND-9.6-ESV.html index 290359b220a..8392768ca3b 100644 --- a/RELEASE-NOTES-BIND-9.6-ESV.html +++ b/RELEASE-NOTES-BIND-9.6-ESV.html @@ -1,26 +1,8 @@ - - - -
-

Introduction

+

Introduction

BIND 9.6-ESV-R5rc1 is the first release @@ -33,7 +15,7 @@

-

Download

+

Download

The latest release of BIND 9 software can always be found @@ -45,7 +27,7 @@

-

Support

+

Support

Product support information is available on http://www.isc.org/services/support @@ -56,9 +38,9 @@

-

New Features

+

New Features

-

9.6-ESV-R5rc1

+

9.6-ESV-R5rc1

  • Added a tool able to generate malformed packets to allow testing @@ -68,11 +50,15 @@ of how named handles them.
-

Security Fixes

+

Security Fixes

-

9.7.4rc1

+

9.6-ESV-R5rc1

  • +Change #2912 (see CHANGES) exposed a latent bug in the DNS message +processing code that could allow certain UPDATE requests to crash named. +[RT #24777] [CVE-2011-2464] +
  • named, set up to be a caching resolver, is vulnerable to a user querying a domain with very large resource record sets (RRSets) when trying to negatively cache the response. Due to an off-by-one @@ -82,9 +68,9 @@ error, caching the response could cause named to crash. [RT #24650]
-

Feature Changes

+

Feature Changes

-

9.6-ESV-R5rc1

+

9.6-ESV-R5rc1

  • Merged in the NetBSD ATF test framework (currently @@ -101,11 +87,15 @@ Replaced compile time constant with STDTIME_ON_32BITS.
-

Bug Fixes

+

Bug Fixes

-

9.6-ESV-R5rc1

+

9.6-ESV-R5rc1

  • +Improved the mechanism for flagging database entries as negative +cache records; the former method, RR type 0, could be ambiguous. +[RT #24777] +
  • During RFC5011 processing some journal write errors were not detected. This could lead to managed-keys changes being committed but not recorded in the journal files, causing potential inconsistencies @@ -238,7 +228,7 @@ without using DLV and had DS records in the parent zone. [RT #24631]
-

Known issues in this release

+

Known issues in this release

  • @@ -259,7 +249,7 @@ without using DLV and had DS records in the parent zone. [RT #24631]

-

Thank You

+

Thank You

Thank you to everyone who assisted us in making this release possible. diff --git a/RELEASE-NOTES-BIND-9.6-ESV.pdf b/RELEASE-NOTES-BIND-9.6-ESV.pdf index 70dd25de724..a2103412e52 100644 Binary files a/RELEASE-NOTES-BIND-9.6-ESV.pdf and b/RELEASE-NOTES-BIND-9.6-ESV.pdf differ diff --git a/RELEASE-NOTES-BIND-9.6-ESV.txt b/RELEASE-NOTES-BIND-9.6-ESV.txt index 3ef7675bf87..484664b561a 100644 --- a/RELEASE-NOTES-BIND-9.6-ESV.txt +++ b/RELEASE-NOTES-BIND-9.6-ESV.txt @@ -32,8 +32,11 @@ New Features Security Fixes -9.7.4rc1 +9.6-ESV-R5rc1 + * Change #2912 (see CHANGES) exposed a latent bug in the DNS message + processing code that could allow certain UPDATE requests to crash + named. [RT #24777] [CVE-2011-2464] * named, set up to be a caching resolver, is vulnerable to a user querying a domain with very large resource record sets (RRSets) when trying to negatively cache the response. Due to an off-by-one @@ -55,6 +58,9 @@ Bug Fixes 9.6-ESV-R5rc1 + * Improved the mechanism for flagging database entries as negative + cache records; the former method, RR type 0, could be ambiguous. + [RT #24777] * During RFC5011 processing some journal write errors were not detected. This could lead to managed-keys changes being committed but not recorded in the journal files, causing potential diff --git a/RELEASE-NOTES-BIND-9.6-ESV.xml b/RELEASE-NOTES-BIND-9.6-ESV.xml index bc59917300b..c39b4a73e8b 100644 --- a/RELEASE-NOTES-BIND-9.6-ESV.xml +++ b/RELEASE-NOTES-BIND-9.6-ESV.xml @@ -1,32 +1,15 @@ - - - -

Introduction - BIND 9.6-ESV-R5 is a maintenance release for BIND 9.6-ESV. + BIND 9.6-ESV-R5rc1 is the first release + candidate of BIND 9.6-ESV-R5. - This document summarizes changes from BIND 9.6-ESV-R4 to BIND 9.6-ESV-R5. + This document summarizes changes from BIND 9.6-ESV-R4 to BIND 9.6-ESV-R5rc1. Please see the CHANGES file in the source code release for a complete list of all changes. @@ -37,7 +20,7 @@ The latest release of BIND 9 software can always be found on our web site at - http://www.isc.org/software/bind. + http://www.isc.org/downloads/all. There you will find additional information about each release, source code, and some pre-compiled versions for certain operating systems. @@ -58,7 +41,7 @@
New Features
- 9.6-ESV-R5 + 9.6-ESV-R5rc1 Added a tool able to generate malformed packets to allow testing @@ -69,10 +52,31 @@ of how named handles them.
+
+ Security Fixes +
+ 9.6-ESV-R5rc1 + + +Change #2912 (see CHANGES) exposed a latent bug in the DNS message +processing code that could allow certain UPDATE requests to crash named. +[RT #24777] [CVE-2011-2464] + + +named, set up to be a caching resolver, is vulnerable to a +user querying a domain with very large resource record sets (RRSets) +when trying to negatively cache the response. Due to an off-by-one +error, caching the response could cause named to crash. [RT #24650] +[CVE-2011-1910] + + +
+
+
Feature Changes
- 9.6-ESV-R5 + 9.6-ESV-R5rc1 Merged in the NetBSD ATF test framework (currently @@ -95,9 +99,14 @@ Replaced compile time constant with STDTIME_ON_32BITS.
Bug Fixes
- 9.6-ESV-R5 + 9.6-ESV-R5rc1 +Improved the mechanism for flagging database entries as negative +cache records; the former method, RR type 0, could be ambiguous. +[RT #24777] + + During RFC5011 processing some journal write errors were not detected. This could lead to managed-keys changes being committed but not recorded in the journal files, causing potential inconsistencies @@ -127,6 +136,9 @@ reload to fail, if a log file specified in the conf file isn't a plain file. (RT #22771] +After an external code review, a code cleanup was done. [RT #22521] + + named now forces the ADB cache time for glue related data to zero instead of relying on TTL. This corrects problematic behavior in cases where a server was authoritative for the A record of a nameserver for a @@ -138,8 +150,8 @@ Fix the zonechecks system test to fail on error (warning in 9.6, fatal in 9.7) to match behaviour for 9.4. [RT #22905] -Fixed precedence order bug with NS and DNAME records if both are present. -[RT #23035] +Fixed precedence order bug with NS and DNAME records if both are +present. (Also fixed timing of autosign test in 9.7+) [RT #23035] The secure zone update feature in named is based on the zone being @@ -247,6 +259,13 @@ When trying sign with NSEC3, if dnssec-signzone couldn't find the KSK, it would give an incorrect error "NSEC3 iterations too big for weakest DNSKEY strength" rather than the correct "failed to find keys at the zone apex: not found" [RT #24369] + + +nsupdate could dump core on shutdown when using SIG(0) keys. [RT #24604] + + +Named could fail to validate zones list in a DLV that validated insecure +without using DLV and had DS records in the parent zone. [RT #24631]