Synopsis

bind-dyndb-ldap bug fix update

Type/Severity

Bug Fix Advisory

Topic

Updated bind-dyndb-ldap packages that fix several bugs are now available for Red Hat Enterprise Linux 6.

Description

The dynamic LDAP back end is a plug-in for BIND that provides back-end capabilities for LDAP databases. It features support for dynamic updates and internal caching that helps to reduce the load on LDAP servers.

This update fixes the following bugs:

• Previously, the bind-dyndb-ldap 2.x driver (used in Red Hat Enterprise Linux 6.x) did not handle forward zones correctly when it was in the same replication topology as bind-dyndb-ldap 6.x (used in Red Hat Enterprise Linux 7.1). As a consequence, forward zones stopped working on all replicas. The underlying source code has been patched to fix this bug, and forward zones now continue to work in the described situation. (BZ#1175318)
  
• The bind-dyndb-ldap library incorrectly compared current time and the expiration time of the Kerberos ticket used for authentication to an LDAP server. As a consequence, the Kerberos ticket was not renewed under certain circumstances, which caused the connection to the LDAP server to fail. The connection failure often happened after a BIND service reload was triggered by the logrotate utility. A patch has been applied to fix this bug, and Kerberos tickets are correctly renewed in this scenario. (BZ#1142176)
  
• Prior to this update, the bind-dyndb-ldap plug-in incorrectly locked certain data structures. Consequently, a race condition during forwarder address reconfiguration could cause BIND to terminate unexpectedly. This bug has been fixed, bind-dyndb-ldap now locks data structures properly, and BIND no longer crashes in this scenario. (BZ#1126841)
  
• Previously, the bind-dyndb-ldap plug-in incorrectly handled timeouts which occurred during LDAP operations. As a consequence, under very specific circumstances, the BIND daemon could terminate unexpectedly. With this update, bind-dyndb-ldap has been fixed to correctly handle timeouts during LDAP operations and the BIND daemon no longer crashes in this scenario. (BZ#1219568)
  
• The documentation for bind-dyndb-ldap-2.3 located in the /usr/share/doc/bind-dyndb-ldap-2.3/README file incorrectly stated that the "idnsAllowTransfer" and "idnsAllowQuery" LDAP attributes are multi-valued. Consequently, users were not able to configure DNS zone transfer and query acess control lists according to the documentation. The documentation has been fixed to explain the correct attribute syntax. (BZ#1183805)
  

Users of bind-dyndb-ldap are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 1126841 - named is crashed due to race condition at the time of access rbt
• BZ - 1142176 - Kerberos ticket is not renewed properly and BIND later deadlocks
• BZ - 1175318 - forward zones stop working if bind-dyndb-ldap 2.x and 6.x are in the same replication topology
• BZ - 1183805 - Documentation for setting multiple values for idnsAllowTransfer idnsAllowQuery is incorrect.
• BZ - 1219568 - recurring named crashes on IPA Server and Replica

CVEs

(none)

References

(none)

Red Hat Enterprise Linux Server 6

SRPM
bind-dyndb-ldap-2.3-8.el6.src.rpm	SHA-256: 938d42f298bab760f32983cd7d1de7969306af3f5dd7784e7d5d5ba6e66266e2
x86_64
bind-dyndb-ldap-2.3-8.el6.x86_64.rpm	SHA-256: ae47cefd711ea50ea244b63c879b18fc894535d62374df3ef02e4cf725dcaaaa
bind-dyndb-ldap-debuginfo-2.3-8.el6.x86_64.rpm	SHA-256: 10658e38dc50f266944ac75408bfede493540f8062f02aa75af2b077ff732288
i386
bind-dyndb-ldap-2.3-8.el6.i686.rpm	SHA-256: e9940608e2fbe241b74fc8bfb8a9e67eadcfb06e93361431751609b65f177d84
bind-dyndb-ldap-debuginfo-2.3-8.el6.i686.rpm	SHA-256: 942bd4d50af675b9ecc2d94d43860b50f1d5b55295d847e2c523d76a226e0004

Red Hat Enterprise Linux Workstation 6

SRPM
bind-dyndb-ldap-2.3-8.el6.src.rpm	SHA-256: 938d42f298bab760f32983cd7d1de7969306af3f5dd7784e7d5d5ba6e66266e2
x86_64
bind-dyndb-ldap-2.3-8.el6.x86_64.rpm	SHA-256: ae47cefd711ea50ea244b63c879b18fc894535d62374df3ef02e4cf725dcaaaa
bind-dyndb-ldap-debuginfo-2.3-8.el6.x86_64.rpm	SHA-256: 10658e38dc50f266944ac75408bfede493540f8062f02aa75af2b077ff732288
i386
bind-dyndb-ldap-2.3-8.el6.i686.rpm	SHA-256: e9940608e2fbe241b74fc8bfb8a9e67eadcfb06e93361431751609b65f177d84
bind-dyndb-ldap-debuginfo-2.3-8.el6.i686.rpm	SHA-256: 942bd4d50af675b9ecc2d94d43860b50f1d5b55295d847e2c523d76a226e0004

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
bind-dyndb-ldap-2.3-8.el6.src.rpm	SHA-256: 938d42f298bab760f32983cd7d1de7969306af3f5dd7784e7d5d5ba6e66266e2
s390x
bind-dyndb-ldap-2.3-8.el6.s390x.rpm	SHA-256: 4df96c562440f5dfcb03e88b1cec4d80e06836083a526f8d2f84e5eff6a1442d
bind-dyndb-ldap-debuginfo-2.3-8.el6.s390x.rpm	SHA-256: ddb7804fed2ef04a4fe12cacd1c3ed01aa8870703fc5cbfccffb8753b5f685bf

Red Hat Enterprise Linux for Power, big endian 6

SRPM
bind-dyndb-ldap-2.3-8.el6.src.rpm	SHA-256: 938d42f298bab760f32983cd7d1de7969306af3f5dd7784e7d5d5ba6e66266e2
ppc64
bind-dyndb-ldap-2.3-8.el6.ppc64.rpm	SHA-256: 7dab6cf479e6a5c82cc8790106d130d2814cce2c73e1496b9c8d79442ff1fef0
bind-dyndb-ldap-debuginfo-2.3-8.el6.ppc64.rpm	SHA-256: 8f30bd26c42b30925d96c1639a4e819d08ba07a0898f4ebb5e36c5d8ec46adbb

Red Hat Enterprise Linux Server from RHUI 6

SRPM
bind-dyndb-ldap-2.3-8.el6.src.rpm	SHA-256: 938d42f298bab760f32983cd7d1de7969306af3f5dd7784e7d5d5ba6e66266e2
x86_64
bind-dyndb-ldap-2.3-8.el6.x86_64.rpm	SHA-256: ae47cefd711ea50ea244b63c879b18fc894535d62374df3ef02e4cf725dcaaaa
bind-dyndb-ldap-debuginfo-2.3-8.el6.x86_64.rpm	SHA-256: 10658e38dc50f266944ac75408bfede493540f8062f02aa75af2b077ff732288
i386
bind-dyndb-ldap-2.3-8.el6.i686.rpm	SHA-256: e9940608e2fbe241b74fc8bfb8a9e67eadcfb06e93361431751609b65f177d84
bind-dyndb-ldap-debuginfo-2.3-8.el6.i686.rpm	SHA-256: 942bd4d50af675b9ecc2d94d43860b50f1d5b55295d847e2c523d76a226e0004