From owner-freebsd-security@FreeBSD.ORG  Sat Jul 12 05:20:55 2008
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A054C106564A;
	Sat, 12 Jul 2008 05:20:55 +0000 (UTC)
	(envelope-from smithi@nimnet.asn.au)
Received: from gaia.nimnet.asn.au (nimbin.lnk.telstra.net [139.130.45.143])
	by mx1.freebsd.org (Postfix) with ESMTP id 0CF558FC14;
	Sat, 12 Jul 2008 05:20:52 +0000 (UTC)
	(envelope-from smithi@nimnet.asn.au)
Received: from localhost (smithi@localhost)
	by gaia.nimnet.asn.au (8.8.8/8.8.8R1.5) with SMTP id OAA05486;
	Sat, 12 Jul 2008 14:49:18 +1000 (EST)
	(envelope-from smithi@nimnet.asn.au)
Date: Sat, 12 Jul 2008 14:49:17 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: Mark Andrews <Mark_Andrews@isc.org>
In-Reply-To: <200807112219.m6BMJmLg042450@drugs.dv.isc.org>
Message-ID: <Pine.BSF.3.96.1080712144107.18279B-100000@gaia.nimnet.asn.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: Doug Barton <dougb@freebsd.org>, stef@memberwebs.com,
	"freebsd-security@freebsd.org" <freebsd-security@freebsd.org>,
	secteam@freebsd.org, Brett Glass <brett@lariat.net>,
	Remko Lodder <remko@freebsd.org>, Andrew Storms <astorms@ncircle.com>
Subject: Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo
	ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile
	distinfo] 
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Jul 2008 05:20:55 -0000

On Sat, 12 Jul 2008, Mark Andrews wrote:
 > 
 > > Is there a way to restrict the ports which BIND selects -- perhaps
 > > at the expense of a small amount of entropy -- such that it doesn't
 > > try to use UDP ports which are administratively blocked (e.g. ports
 > > used by worms, or insecure Microsoft network utilities)? We don't 
 > > dare turn these port blocks off, or naive users will fall prey to 
 > > security holes in Microsoft products. But if BIND doesn't know to
 > > work around them, lookups will occasionally (and infuriatingly!)
 > > fail.
 > 
 > % grep avoid doc/misc/options 
 >         avoid-v4-udp-ports { <port>; ... };
 >         avoid-v6-udp-ports { <port>; ... };
 > % 

This seems to imply that you can't specify ranges of UDP ports to avoid
here.  For example perhaps, the range traceroute uses .. 

Doug responded with a new option for a range of ports to use, but an
intersection of ports to use and ^ports to avoid, including range(s),
would cover all the bases ..

cheers, Ian