From owner-freebsd-security@FreeBSD.ORG  Thu Feb  1 20:58:55 2007
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 3E33016A400
	for <freebsd-security@freebsd.org>;
	Thu,  1 Feb 2007 20:58:55 +0000 (UTC) (envelope-from cswiger@mac.com)
Received: from pi.codefab.com (pi.codefab.com [199.103.21.227])
	by mx1.freebsd.org (Postfix) with ESMTP id 1182513C4AA
	for <freebsd-security@freebsd.org>;
	Thu,  1 Feb 2007 20:58:54 +0000 (UTC) (envelope-from cswiger@mac.com)
Received: from localhost (localhost [127.0.0.1])
	by pi.codefab.com (Postfix) with ESMTP id B547360CB;
	Thu,  1 Feb 2007 15:28:11 -0500 (EST)
X-Virus-Scanned: amavisd-new at codefab.com
Received: from pi.codefab.com ([127.0.0.1])
	by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id uW4Y4MkOsVPG; Thu,  1 Feb 2007 15:28:09 -0500 (EST)
Received: from [192.168.1.251] (pool-68-161-114-230.ny325.east.verizon.net
	[68.161.114.230])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by pi.codefab.com (Postfix) with ESMTP id E437A5DBD;
	Thu,  1 Feb 2007 15:28:08 -0500 (EST)
Message-ID: <45C24D57.3000704@mac.com>
Date: Thu, 01 Feb 2007 15:28:07 -0500
From: Chuck Swiger <cswiger@mac.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Doug Barton <dougb@FreeBSD.org>
References: <001601c74428$ff9d54b0$ab76ed54@odipw>
	<45BEE27D.1050804@FreeBSD.org> <45BFA1B3.9040000@rxsec.com>
	<45C23DAA.9040108@FreeBSD.org>
In-Reply-To: <45C23DAA.9040108@FreeBSD.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-security@freebsd.org, Chris Marlatt <cmarlatt@rxsec.com>
Subject: Re: What about BIND 9.3.4 in FreeBSD in base system ?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Feb 2007 20:58:55 -0000

Doug Barton wrote:
> Chris Marlatt wrote:
[ ... ]
> Yes, but whether a full upgrade is needed for "support" or not depends 
> on your definition. Given that FreeBSD is not vulnerable to these issues 
> in its default configuration, one could easily argue that an upgrade for 
> RELENG_5 isn't necessary.

I've been bitten by CVE-2006-4096, and have applied the workaround to limit 
the # of outstanding queries.  I've got two nameservers tracking 5-STABLE 
which were vulnerable to CVE-2006-4095, and I have no doubt that there are 
other people besides me who will be affected by CVE-2007-0493.

I'm starting to feel thankful that my important domains include off-site 
secondaries which are running djbdns.

Does the FreeBSD security team have a position with regard to whether the 
above DoS vulnerabilities ought to be fixed in the 5-STABLE branch?

-- 
-Chuck