[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 20 Aug 2021 13:24:07 -0800
From: Michael McNally <mcnally@....org>
To: oss-security@...ts.openwall.com
Cc: "security-officer@....org" <security-officer@....org>
Subject: August BIND maintenance releases contain a defect affecting servers
using the map zone file format (was: A vulnerability in BIND (CVE-2021-25218)
will be announced 18 August 2021)
Hello oss-security subscribers --
Earlier in the week we (Internet Systems Consortium) posted information to this list
about new versions of our BIND software which contained a fix for an exploitable
denial-of-service vector, CVE-2021-25218.
The replacement versions contained other fixes, one of which has caused a new
problem of which we would like to make you aware. It is not an exploitable security
vulnerability but we would like to make sure that packagers who prepared replacement
versions of BIND after receiving our previous message are aware of this additional
issue, as it will affect users who use a specific BIND feature.
Originally the message below was sent to the distros list; I am informed that this
list was a more appropriate destination for it.
Apologies for our confusion over which list to use, as well as the additional work
caused by the new defect, but if you package and redistribute BIND please take note
of the Operational Notification linked from the message quoted below.
Thank you,
Michael McNally
ISC Security Officer
-------- Forwarded Message --------
Subject: [vs] August BIND maintenance releases contain a defect affecting servers using
the map zone file format (was: A vulnerability in BIND (CVE-2021-25218) will be announced
18 August 2021)
Date: Fri, 20 Aug 2021 02:37:19 -0800
From: ISC Security Officer <security-officer@....org>
To: Michael McNally <mcnally@....org>, distros@...openwall.org
To the packagers and redistributors of BIND 9:
We recently contacted this list with information about CVE-2021-25218,
a vulnerability affecting the 9.16.x and 9.17.x branches of BIND,
and provided new versions of the software containing a fix for that
vulnerability.
Unfortunately an issue has been discovered in the releases which
corrected that CVE bug. The new defect is not a remotely exploitable
attack vector, and so is arguably off-topic for this list, but as we
had previously advised packagers to update their packages based on
the new versions we wanted to inform you about a problem discovered in
those versions.
The new defect arises from a failure to properly increment the API
version of the file format for zones stored in BIND's "map" format.
As a consequence of this oversight, affected servers can terminate
with an assertion failure when trying to read zone data stored in a
file written by a previous version of the software.
More complete details are available in this Operational Notification
in the ISC Knowledge Base:
https://kb.isc.org/docs/map-zone-format-incompatibility-in-bind-9-16-20-and-9-17-17
For the benefit of packagers we have prepared patch diffs which
increment the API version of the map format. BIND packages built
from patched source will detect that files written in obsolete
versions of the map file format are incompatible, will log a
message and move the file to an archive version, and will retransfer
the zone from its source on a primary server, which is the normally
expected behavior when the map zone file format changes.
Patches are available in the patches subdirectories of the recent
releases, i.e.:
9.16.20: https://downloads.isc.org/isc/bind9/9.16.20/patches
9.17.17: https://downloads.isc.org/isc/bind9/9.17.17/patches
We're sorry for the error and for the extra work created for those
repackaging our software.
If you have further questions about this after reading the Operational
Notification, please direct them to security-officer@....org
Thank you,
Michael McNally
ISC Security Officer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
