From owner-freebsd-security@FreeBSD.ORG Fri Feb 2 18:27:33 2007 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id C756816A406; Fri, 2 Feb 2007 18:27:33 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from pi.codefab.com (pi.codefab.com [199.103.21.227]) by mx1.freebsd.org (Postfix) with ESMTP id 92FA313C49D; Fri, 2 Feb 2007 18:27:33 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from localhost (localhost [127.0.0.1]) by pi.codefab.com (Postfix) with ESMTP id ECA195DBD; Fri, 2 Feb 2007 13:27:32 -0500 (EST) X-Virus-Scanned: amavisd-new at codefab.com Received: from pi.codefab.com ([127.0.0.1]) by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lfxoK2TNGsLL; Fri, 2 Feb 2007 13:27:28 -0500 (EST) Received: from [192.168.1.251] (pool-68-161-114-230.ny325.east.verizon.net [68.161.114.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pi.codefab.com (Postfix) with ESMTP id 23F235C74; Fri, 2 Feb 2007 13:27:28 -0500 (EST) Message-ID: <45C3828D.8010900@mac.com> Date: Fri, 02 Feb 2007 13:27:25 -0500 From: Chuck Swiger User-Agent: Thunderbird 1.5.0.9 (Windows/20061207) MIME-Version: 1.0 To: Doug Barton References: <001601c74428$ff9d54b0$ab76ed54@odipw> <45BEE27D.1050804@FreeBSD.org> <45BFA1B3.9040000@rxsec.com> <45C23DAA.9040108@FreeBSD.org> <45C24D57.3000704@mac.com> <45C25696.10806@FreeBSD.org> <45C26ACC.9020702@mac.com> <45C2E870.5000000@FreeBSD.org> In-Reply-To: <45C2E870.5000000@FreeBSD.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-security@freebsd.org Subject: Re: What about BIND 9.3.4 in FreeBSD in base system ? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Feb 2007 18:27:33 -0000 Doug Barton wrote: > Chuck Swiger wrote: >> Doug Barton wrote: [ ... ] > Right. As I understood it, you were arguing in favor of MFC'ing a fix to > RELENG_5 because you have machines from that branch in a production > setting. If I misunderstood your point, I apologize. I would like CVE-2007-0493 fixed in RELENG_5 and RELENG_5_5, specifically, yes please. More generally, I would like BIND to deal with hundreds (or-- preferably but not required-- thousands) of outstanding recursive queries without dumping core or becoming non-responsive. Have you attempted to reproduce the issue via the adns port or anything else which generates lots of queries? >> When the number of machines one deals with in a given environment >> changes from single-digit, to dozens, to hundreds, to tens of >> thousands, keeping machines updated to a bug-free, stable environment >> is more important than chasing features off the latest branch. > > Yes, I understand those issues quite well. I used to manage hundreds of > name servers for a company that had many 10s of thousands of machines. > And I think that you are basically making my point, which is that users > in a serious production environment are probably not using the BIND that > comes with FreeBSD in an off the shelf configuration. It would be safe to say that almost all people using BIND are not using a completely off-the-shelf configuration, unless you count the few only running as "caching-only". -- -Chuck