Date: Fri, 20 Aug 2021 13:24:07 -0800 From: Michael McNally <mcnally@....org> To: oss-security@...ts.openwall.com Cc: "security-officer@....org" <security-officer@....org> Subject: August BIND maintenance releases contain a defect affecting servers using the map zone file format (was: A vulnerability in BIND (CVE-2021-25218) will be announced 18 August 2021) Hello oss-security subscribers -- Earlier in the week we (Internet Systems Consortium) posted information to this list about new versions of our BIND software which contained a fix for an exploitable denial-of-service vector, CVE-2021-25218. The replacement versions contained other fixes, one of which has caused a new problem of which we would like to make you aware. It is not an exploitable security vulnerability but we would like to make sure that packagers who prepared replacement versions of BIND after receiving our previous message are aware of this additional issue, as it will affect users who use a specific BIND feature. Originally the message below was sent to the distros list; I am informed that this list was a more appropriate destination for it. Apologies for our confusion over which list to use, as well as the additional work caused by the new defect, but if you package and redistribute BIND please take note of the Operational Notification linked from the message quoted below. Thank you, Michael McNally ISC Security Officer -------- Forwarded Message -------- Subject: [vs] August BIND maintenance releases contain a defect affecting servers using the map zone file format (was: A vulnerability in BIND (CVE-2021-25218) will be announced 18 August 2021) Date: Fri, 20 Aug 2021 02:37:19 -0800 From: ISC Security Officer <security-officer@....org> To: Michael McNally <mcnally@....org>, distros@...openwall.org To the packagers and redistributors of BIND 9: We recently contacted this list with information about CVE-2021-25218, a vulnerability affecting the 9.16.x and 9.17.x branches of BIND, and provided new versions of the software containing a fix for that vulnerability. Unfortunately an issue has been discovered in the releases which corrected that CVE bug. The new defect is not a remotely exploitable attack vector, and so is arguably off-topic for this list, but as we had previously advised packagers to update their packages based on the new versions we wanted to inform you about a problem discovered in those versions. The new defect arises from a failure to properly increment the API version of the file format for zones stored in BIND's "map" format. As a consequence of this oversight, affected servers can terminate with an assertion failure when trying to read zone data stored in a file written by a previous version of the software. More complete details are available in this Operational Notification in the ISC Knowledge Base: https://kb.isc.org/docs/map-zone-format-incompatibility-in-bind-9-16-20-and-9-17-17 For the benefit of packagers we have prepared patch diffs which increment the API version of the map format. BIND packages built from patched source will detect that files written in obsolete versions of the map file format are incompatible, will log a message and move the file to an archive version, and will retransfer the zone from its source on a primary server, which is the normally expected behavior when the map zone file format changes. Patches are available in the patches subdirectories of the recent releases, i.e.: 9.16.20: https://downloads.isc.org/isc/bind9/9.16.20/patches 9.17.17: https://downloads.isc.org/isc/bind9/9.17.17/patches We're sorry for the error and for the extra work created for those repackaging our software. If you have further questions about this after reading the Operational Notification, please direct them to security-officer@....org Thank you, Michael McNally ISC Security Officer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.