42 lines
1.9 KiB
XML
42 lines
1.9 KiB
XML
<!--
|
|
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
-
|
|
- This Source Code Form is subject to the terms of the Mozilla Public
|
|
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
- file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
-
|
|
- See the COPYRIGHT file distributed with this work for additional
|
|
- information regarding copyright ownership.
|
|
-->
|
|
|
|
<section xml:id="relnotes-9.11.36"><info><title>Notes for BIND 9.11.36</title></info>
|
|
|
|
<section xml:id="relnotes-9.11.36-security"><info><title>Security Fixes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
The <command>lame-ttl</command> option controls how long
|
|
<command>named</command> caches certain types of broken responses from
|
|
authoritative servers (see the <link xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xlink:href="https://kb.isc.org/docs/cve-2021-25219">security advisory</link>
|
|
for details). This caching mechanism could be abused by an attacker to
|
|
significantly degrade resolver performance. The vulnerability has been
|
|
mitigated by changing the default value of <command>lame-ttl</command>
|
|
to <command>0</command> and overriding any explicitly set value with
|
|
<command>0</command>, effectively disabling this mechanism altogether.
|
|
ISC's testing has determined that doing that has a negligible impact
|
|
on resolver performance while also preventing abuse. Administrators
|
|
may observe more traffic towards servers issuing certain types of
|
|
broken responses than in previous BIND 9 releases, depending on client
|
|
query patterns. (CVE-2021-25219)
|
|
</para>
|
|
<para>
|
|
ISC would like to thank Kishore Kumar Kothapalli of Infoblox for
|
|
bringing this vulnerability to our attention. [GL #2899]
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
</section>
|