RHBA-2015:2222 - Bug Fix Advisory

Topic

Updated bind packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

BIND (Berkeley Internet Name Domain) is an implementation of the DNS protocols. BIND includes a DNS server (named), which resolves host names to IP addresses, a resolver library, and tools for verifying that the DNS server is operating correctly.

This update fixes the following bugs:

• The named(8) man page previously contained outdated information when mentioning system-config-bind not available in Red Hat Enterprise Linux. This update removes this information. (BZ#1152066)
• Previously, bind configuration for the logrotate utility used an incorrect path to the systemctl command, which led to the named daemon not being reloaded after the log was rotated. The path to the systemctl command has been fixed, and named is now successfully reloaded in the described scenario. (BZ#1164264)
• The bind packages previously installed the tmpfiles configuration file into the /etc/tmpfiles.d/ directory. As a consequence, the administrator's changes made in /etc/tmpfiles.d/ were overwritten on package reinstall or update. This update fixes the bind source code to install tmpfiles into /usr/lib/tmpfiles.d/, and the administrator's configuration changes in tmpfiles are thus preserved on package reinstall or update. (BZ#1180976)
• Previously, the nsupdate utility was extracting REALM from the local kerberos ticket if the REALM was not specified explicitly as an option. Consequently, in cross-realm trust scenarios, the REALM was not correct if the update was supposed to be sent to the name server from another REALM. With this update, the REALM detection is determined by GSSAPI if not specified explicitly with an option. (BZ#1214827)
• The version of BIND included in Red Hat Enterprise Linux 7 contained a check for SPF records in zone files not conforming to RFC 7208. Consequently, if the zone file contained SPF records, the BIND server or the named-checkzone utility could issue a warning message even though SPF was valid. The check for SPF records has been updated to conform to RFC 7208, and BIND server or named-checkzone no longer issue any incorrect messages. (BZ#1215164)
• Due to the limits in the resolver being set too small, the resolver was under heavy load and some clients could receive SERVFAIL response from the server. Internal hardcoded limits in the resolver have been increased to reflect the latest upstream limits. (BZ#1221180)
• As Internet Systems Consortium (ISC) decided to deprecate the DNSSEC Look-aside Validation (DLV) registry, the use of DLV registry has been removed from the BIND server default configuration. (BZ#1223336)
• When a BIND server was processing a high number of client requests, some of the queries timed out with a SERVFAIL status message from the server. This update increases the values of multiple internal limits, and the described query timeouts thus no longer occur. (BZ#1235609)
• Due to the missing DISABLE_ZONE_CHECKING option in the /etc/sysconfig/named file, the user could not disable the zone checking on named start. This update adds DISABLE_ZONE_CHECKING, the functionality of which is to bypass zone validation via the named-checkzone utility in the systemd service file, back to /etc/sysconfig/named, and thus allows to start named with misconfigured zones. (BZ#1236475)
• Previously, the /etc/localtime file was copied into the bind-chroot root (/var/named/chroot/) during the installation of the bind-chroot packages. However, Anaconda could not create /etc/localtime before installation, which caused bind-chroot to produce an error message and /etc/localtime was not copied into the chroot root directory. The /etc/localtime file is now bind-mounted on every service start, and if /etc/localtime is not present in the time of package installation, no error message is printed. (BZ#1186773)

Users of bind are advised to upgrade to these updated packages, which fix these bugs. After installing the update, the BIND daemon (named) will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1164264 - /etc/logrotate.d/named should use /usr/bin/systemctl instead of /sbin/systemctl
• BZ - 1180976 - Bind is installing files under /etc/tmpfiles.d/
• BZ - 1214827 - nsupdate realm auto-detection is broken
• BZ - 1215164 - Bind indicates an error on a proper SPF record
• BZ - 1223336 - Remove usage of DLV from the default configuration

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal