RHBA-2015:0424 - Bug Fix Advisory

Topic

Updated bind-dyndb-ldap packages that fix several bugs and add various
enhancements are now available for Red Hat Enterprise Linux 7.

Description

The dynamic LDAP back end is a plug-in for BIND that provides back-end
capabilities for LDAP databases. It features support for dynamic updates and
internal caching that helps to reduce the load on LDAP servers.

The bind-dyndb-ldap packages have been upgraded to upstream version 6.0, which
provides a number of bug fixes and enhancements over the previous version. The
most notable enhancements are as follows:

• The read query performance has been improved to be nearly the same as with

plain BIND, and queries for non-existing records do not impose additional load
on an LDAP server.

• Support for Wildcard records according to RFC 4592 has been added.
• Support for Incremental Zone Transfers (IXFR) according to RFC 1995 has been

added.

• The DNS root zone (".") can now be stored in LDAP.
• DNS Security Extensions (DNSSEC) in-line signing is now supported for master

zones; any master zone in
LDAP can be signed with keys provided by the user.
(BZ#1109759)

The behavioral changes and upgrade procedure are described in the following
Knowledge Article:
https://access.redhat.com/articles/1293133

This update also fixes the following bugs:

• Kerberos ticket expiration is now handled correctly. (BZ#1109759)
• Previously, the bind-dyndb-ldap plug-in did not fully support the DNS64

technology. As a consequence, the BIND daemon configured with DNS64 terminated
unexpectedly when a DNS64 query was processed by bind-dyndb-ldap. The bug has
been fixed and the BIND daemon no longer crashes in this scenario. (BZ#1078295)

Users of bind-dyndb-ldap are advised to upgrade to these updated packages, which
fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1078295 - bind-dyndb-ldap crashes when handling DNS64 query
• BZ - 1109759 - Rebase bind-dyndb-ldap to latest upstream version
• BZ - 1138317 - Implement Handling of idnsZoneActive Attribute
• BZ - 1161635 - DNS notify messages are not sent for modifications outside zone apex
• BZ - 1168131 - Crash caused by NS record & forward zone interaction

CVEs

(none)

References

• https://access.redhat.com/articles/1293133