RHBA-2007:0743 - Bug Fix Advisory

Topic

Updated bind packages which fix various bugs and add enhancements are
now available.

Description

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named), which
resolves host names to IP addresses; a resolver library (routines for
applications to use when interfacing with DNS); and tools for verifying
that the DNS server is operating correctly.

These updated packages fix the following issues:

• during a zone transfer, a denial of service (DoS) was possible if an

attacker sent a Transaction Signature (TSIG) request, then sent a second,
malformed TSIG request. However, to be successful the TSIGs had to be
successfully authenticated, which greatly limited exploitation
possibilities.

• bind-chroot creates various files such as /dev/random and /dev/zero so

that bind can successfully run in a chroot jail. However, when uninstalling
bind-chroot, these files are not removed. In these updated packages
uninstalling bind-chroot removes these files.

• the bind init script used to start bind in a chroot jail mounts the /proc

file system. Using the same init script to stop bind resulted in /proc not
being unmounted. At this point, starting bind could result in an error
about /proc already being mounted. In these updated packages /proc is
correctly unmounted.

• the "host" command had a return code of zero (successful) even when a

host wasn't found.

• an update to bind-chroot resulted in a "missing ';' before '}'" error

when using rndc. This was caused by bind-choot not generating rndc.key
correctly. The rndc.key file is correctly generated with these updated
packages.

• in previous packages /var/named/proc/chroot wasn't hidden. This resulted

in the df command returning "`/var/named/chroot/proc': Permission denied".
In these updated packages /var/named/proc/chroot is hidden.

This update also adds the following enhancements:

• the bind init script now has a "configtest" parameter which calls

named-checkconf. This serves to make managing services easier without
having to remember the name of each service's configuration-checking tool.

• Extended Domain Name System (EDNS) was enabled globally by default. This

caused EDNS packets to be sent to root nameservers which usually responded
with "format error". CheckPoint Firewall 1 would log these packets and
eventually crash. Other commercial firewalls may be affected. You can now
disable EDNS globally by specifying "edns no" in the bind configuration
file, named.conf.

Users are advised to upgrade to these updated packages, which resolve these
issues and add these enhancements.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 157601 - A 'configtest' parameter for the named service (attached).
• BZ - 192192 - BIND TSIG DoS
• BZ - 202441 - chroot'd named causes df permission denied error
• BZ - 205266 - bind-chroot doesn't clean up its mess on %preun
• BZ - 211282 - EDNS is globally enabled, crashing CheckPoint FW-1
• BZ - 219473 - "host" command from bind-utils package returns zero whether the host resolves or not.
• BZ - 227798 - update of bind-chroot breaks rndc.key and named won't start

CVEs

(none)

References

(none)