RHBA-2015:0357 - Bug Fix Advisory

Topic

Updated bind packages that fix several bugs and add one enhancement are now
available for Red Hat Enterprise Linux 7.

Description

BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name
System (DNS) protocols. BIND includes a DNS server (named), which resolves host
names to IP addresses, a resolver library (routines for applications to use when
interfacing with DNS), and tools for verifying that the DNS server is operating
correctly.

This update fixes the following bugs:

• The "allow-notify" configuration option did not take into account the

Transaction SIGnature (TSIG) key for authentication. This caused a slave server
to not accept a NOTIFY message from a non-master server that used the TSIG key
for authentication, even though the slave server was configured to accept NOTIFY
messages when the specific TSIG key was used. The named source code has been
fixed to also check the TSIG key ID when receiving a NOTIFY message from a
non-master server, and the slave server now correctly accepts NOTIFY messages in
this scenario. (BZ#1067424)

• A bug in the BIND resolver source code caused a race condition, which could

lead to prematurely freeing a fetch memory object. BIND could terminate
unexpectedly with a segmentation fault when it accessed already freed memory.
The BIND resolver source code has been fixed to ensure that the resolver fetch
objects are not freed until there are no outstanding references to them, and
BIND no longer crashes in this scenario. (BZ#1072379)

• BIND incorrectly handled errors returned by dynamic databases (from dyndb

API). Consequently, BIND could enter a deadlock situation on shutdown under
certain circumstances. The dyndb API has been fixed to not cause a deadlock
during BIND shutdown after the dynamic database returns an error, and BIND now
shuts down normally in the described situation. (BZ#1142150)

• BIND was not configured with the "--with-dlopen=yes" option. Consequently,

external Dynamically Loadable Zones (DLZ) drivers could not be dynamically
loaded. A patch has been applied, and external DLZ drivers are now dynamically
loadable as expected. (BZ#1096688)

• The /dev/random device did not have a sufficient amount of entropy when

booting a newly installed virtual machine. Generating the /etc/rndc.key file
took excessively long when the named service was started for the first time. The
init script has been changed to use /dev/urandom instead of /dev/random as the
source of random data, and the generation of /etc/rndc.key now consumes
noticeably less amount of time in this scenario. (BZ#1107568)

• The /var/named/chroot/var/run/ directory, present in the bind-chroot

subpackage in Red Hat Enterprise Linux 6, was replaced by a symbolic link with
the same path in Red Hat Enterprise Linux 7. Consequently, an attempt to install
the new version of bind-chroot during an in-place upgrade from Red Hat
Enterprise Linux 6 to the later version failed because RPM was unable to install
the symbolic link; the upgraded Red Hat Enterprise Linux 7 system still
contained the Red Hat Enterprise Linux 6 version of bind-chroot. The bind-chroot
subpackage has been updated to remove the directory during an update. The
symbolic link is now successfully installed, and bind-chroot is successfully
updated in this situation. (BZ#1091341)

In addition, this update adds the following enhancement:

• The number of workers and client objects was hard-coded in the Lightweight

Resolver Daemon (lwresd) source, and it was insufficient. This update adds two
new options: the "lwres-tasks" option can be used to modify the number of
workers created, and the "lwres-clients" option can be used to specify the
number of client objects created per worker. The options can be used inside the
lwres statement in the named/lwresd configuration file. (BZ#1098959)

Users of bind are advised to upgrade to these updated packages, which fix these
bugs and add this enhancement. After installing the update, the BIND daemon
(named) will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1096688 - Enable dlopen-type DLZ modules in Bind
• BZ - 1142150 - bind hangs after reload/GSSAPI Error: The referenced context has expired (Success)
• BZ - 1143033 - bind.spec: E: specfile-error warning: line 643: Invalid version (double separator '-'): bind-9.9.0-0.6.rc1: %post libs -p /sbin/ldconfig

CVEs

(none)

References

(none)