From owner-freebsd-security@FreeBSD.ORG  Wed Jul  9 10:54:06 2008
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id D02951065677
	for <freebsd-security@FreeBSD.ORG>;
	Wed,  9 Jul 2008 10:54:06 +0000 (UTC)
	(envelope-from olli@lurza.secnetix.de)
Received: from lurza.secnetix.de (unknown [IPv6:2a01:170:102f::2])
	by mx1.freebsd.org (Postfix) with ESMTP id 4B95D8FC1B
	for <freebsd-security@FreeBSD.ORG>;
	Wed,  9 Jul 2008 10:54:06 +0000 (UTC)
	(envelope-from olli@lurza.secnetix.de)
Received: from lurza.secnetix.de (localhost [127.0.0.1])
	by lurza.secnetix.de (8.14.1/8.14.1) with ESMTP id m69As4vI065392;
	Wed, 9 Jul 2008 12:54:04 +0200 (CEST)
	(envelope-from oliver.fromme@secnetix.de)
Received: (from olli@localhost)
	by lurza.secnetix.de (8.14.1/8.14.1/Submit) id m69As4eH065391;
	Wed, 9 Jul 2008 12:54:04 +0200 (CEST) (envelope-from olli)
Date: Wed, 9 Jul 2008 12:54:04 +0200 (CEST)
Message-Id: <200807091054.m69As4eH065391@lurza.secnetix.de>
From: Oliver Fromme <olli@lurza.secnetix.de>
To: freebsd-security@FreeBSD.ORG
In-Reply-To: <C4990135.1A0907%astorms@ncircle.com>
X-Newsgroups: list.freebsd-security
User-Agent: tin/1.8.3-20070201 ("Scotasay") (UNIX)
	(FreeBSD/6.2-STABLE-20070808 (i386))
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.1.2
	(lurza.secnetix.de [127.0.0.1]);
	Wed, 09 Jul 2008 12:54:05 +0200 (CEST)
X-Mailman-Approved-At: Wed, 09 Jul 2008 11:35:59 +0000
Cc: 
Subject: Re: BIND update?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Jul 2008 10:54:06 -0000

Andrew Storms wrote:
 > http://www.isc.org/index.pl?/sw/bind/bind-security.php

I'm just wondering ...

ISC's patches cause source ports to be randomized, thus
making it more difficult to spoof response packets.

But doesn't FreeBSD already randomize source ports by
default?  So, do FreeBSD systems require to be patched
at all?

Best regards
   Oliver

PS:
$ sysctl net.inet.ip.portrange.randomized
net.inet.ip.portrange.randomized: 1
$ sysctl -d net.inet.ip.portrange.randomized
net.inet.ip.portrange.randomized: Enable random port allocation

-- 
Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing b. M.
Handelsregister: Registergericht Muenchen, HRA 74606,  Geschäftsfuehrung:
secnetix Verwaltungsgesellsch. mbH, Handelsregister: Registergericht Mün-
chen, HRB 125758,  Geschäftsführer: Maik Bachmann, Olaf Erb, Ralf Gebhart

FreeBSD-Dienstleistungen, -Produkte und mehr:  http://www.secnetix.de/bsd

It's trivial to make fun of Microsoft products,
but it takes a real man to make them work,
and a God to make them do anything useful.