RHBA-2009:0246 - Bug Fix Advisory

Topic

Updated bind packages that resolve several issues are now available for Red
Hat Enterprise Linux 5.

Description

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.

These updated bind packages provide fixes for the following bugs:

• the bind-chroot-admin script did not preserve the user-supplied chroot

directory. Any user-supplied value for ROOTDIR was reset to the default
ROOTDIR during a bind-chroot update. As a result, name servers could
silently fail in a way which was difficult to diagnose. This updated
version of BIND will not reset user-supplied ROOTDIR values.

Note: It is not necessary to run the named daemon in a chroot environment
if the Red Hat SELinux policy for named is enabled. When enabled, this
policy is far more secure than a chroot environment. Users are recommended
to enable SELinux and remove the bind-chroot package.

• if the user provided incorrect syntax to the "rndc reload" command, named

could crash. On receiving incorrect syntax for "rndc reload", the version
of rndc provided with this advisory will report an error but will not crash
named.

• previously, the open files limit was set to 1000 by default. On

high-volume servers, this could lead to TCP queries timing out. The version
of BIND provided with this advisory has the open files limit set to
"unlimited" by default.

Note that previous documentation stated that the open files limit was set
to "unlimited", even though this was not the case.

• the bind-sdb installation script set the ownership of the

/etc/openldap/slapd.conf configuration file to "root" when it should have
been set to "ldap". This incorrect permission prevented the slapd daemon
from starting. The version of the script included in this update sets the
file owner correctly, thus allowing slapd to start.

• although BIND itself included support for the "krb5-self" and

"krb5-subdomain" options, this support was missing from the configuration
file parser. This made it impossible to configure BIND to use these
options. These updated bind packages now recognize these options.

• these updated bind packages provide a modified "named" init script in

which the reload() function returns an error status the reload failed.

• previously, permissions on BIND executables were set so that the files

could not be read or executed by users in the "others" group. This required
users to have elevated privileges in order to use BIND utilities such as
rndc. These permissions have been revised in this updated version of BIND
so that users in the "others" group may execute them. However, the
configuration files remain protected.

All users of bind are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 437789 - bind install script changes the group owner of /etc/openldap/slapd.conf
• BZ - 441495 - No reason for bind binaries to be protected
• BZ - 451450 - bind-chroot update overwrites user supplied ROOTDIR setting
• BZ - 457533 - named crashes on incorrect usage of rndc reload command
• BZ - 457932 - Bind doesn't support krb5-self and krb5-subdomain options of the update-policy clause
• BZ - 458932 - named TCP connections hang

CVEs

(none)

References

(none)