Bind 9.10.3 P4 发布,DNS服务器软件

来源: OSCHINA
编辑: oschina
2016-03-10

Bind 9.10.3 P4 发布了。Bind是一款开放源码的DNS服务器软件,Bind由美国加州大学Berkeley分校开发和维护的,全名为Berkeley Internet Name Domain它是目前世界上使用最为广泛的DNS服务器软件,支持各种unix平台和windows平台。

安全更新:

  • An incorrect boundary check in the OPENPGPKEY rdatatype  could trigger an assertion failure. This flaw is disclosed  in CVE-2015-5986. [RT #40286]

  • A buffer accounting error could trigger an assertion failure  when parsing certain malformedDNSSECkeys.

    This flaw was discovered by Hanno Böck of the Fuzzing  Project, and is disclosed in CVE-2015-5722. [RT #40212]

  • A specially crafted query could trigger an assertion failure  in message.c.

    This flaw was discovered by Jonathan Foote, and is disclosed  in CVE-2015-5477. [RT #40046]

  • On servers configured to performDNSSECvalidation, an  assertion failure could be triggered on answers from  a specially configured server.

    This flaw was discovered by Breno Silveira Soares, and is  disclosed in CVE-2015-4620. [RT #39795]

新特性:

  • New quotas have been added to limit the queries that are  sent by recursive resolvers to authoritative servers  experiencing denial-of-service attacks. When configured,  these options can both reduce the harm done to authoritative  servers and also avoid the resource exhaustion that can be  experienced by recursives when they are being used as a  vehicle for such an attack.

    NOTE: These options are not available by default; use  configure --enable-fetchlimit to include  them in the build.

    Statistics counters have also been added to track the number  of queries affected by these quotas.

    • fetches-per-server limits the number of      simultaneous queries that can be sent to any single      authoritative server.  The configured value is a starting      point; it is automatically adjusted downward if the server is      partially or completely non-responsive. The algorithm used to      adjust the quota can be configured via the      fetch-quota-params option.    

    • fetches-per-zone limits the number of      simultaneous queries that can be sent for names within a      single domain.  (Note: Unlike "fetches-per-server", this      value is not self-tuning.)    

  • dig +ednsflags can now be used to set          yet-to-be-definedEDNSflags inDNSrequests.

  • dig +[no]ednsnegotiation can now be used enable /  disableEDNSversion negotiation.

  • An --enable-querytrace configure switch is  now available to enable very verbose query tracelogging. This  option can only be set at compile time. This option has a  negative performance impact and should be used only for  debugging.

Bug 修复:

  • Asynchronous zone loads were not handled correctly when the  zone load was already in progress; this could trigger a crash  in zt.c. [RT #37573]

  • A race during shutdown or reconfiguration could  cause an assertion failure in mem.c. [RT #38979]

  • Some answer formatting options didn't work correctly with  dig +short. [RT #39291]

  • Malformed records of some types, including NSAP and UNSPEC,  could trigger assertion failures when loading text zone files.  [RT #40274] [RT #40285]

  • Fixed a possible crash in ratelimiter.c caused by NOTIFY  messages being removed from the wrong rate limiter queue.  [RT #40350]

  • The default rrset-order of random  was inconsistently applied. [RT #40456]

  • BADVERS responses from broken authoritative name servers were  not handled correctly. [RT #40427]

  • Several bugs have been fixed in the RPZ implementation

下载地址:https://www.isc.org/downloads/

展开阅读全文
16 收藏
分享
加载中
最新评论 (1)
mark
2016-03-12 23:17
0
回复
举报
更多评论
1 评论
16 收藏
分享
返回顶部
顶部