From owner-freebsd-security@FreeBSD.ORG Sat Feb 10 04:25:43 2007 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 527E116A403 for ; Sat, 10 Feb 2007 04:25:43 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from mx.isc.org (mx.isc.org [204.152.184.167]) by mx1.freebsd.org (Postfix) with ESMTP id 3CE0E13C49D for ; Sat, 10 Feb 2007 04:25:43 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from farside.isc.org (farside.isc.org [IPv6:2001:4f8:3:bb::5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "farside.isc.org", Issuer "ISC CA" (verified OK)) by mx.isc.org (Postfix) with ESMTP id 64CEB114025 for ; Sat, 10 Feb 2007 04:25:42 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from drugs.dv.isc.org (localhost.isc.org [IPv6:::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (verified OK)) by farside.isc.org (Postfix) with ESMTP id C95F0E601F for ; Sat, 10 Feb 2007 04:25:41 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.13.8/8.13.8) with ESMTP id l1A4Pab2073080 for ; Sat, 10 Feb 2007 15:25:38 +1100 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200702100425.l1A4Pab2073080@drugs.dv.isc.org> To: freebsd-security@freebsd.org From: Mark Andrews In-reply-to: Your message of "Fri, 09 Feb 2007 20:42:01 GMT." <200702092042.l19Kg1UV023236@freefall.freebsd.org> Date: Sat, 10 Feb 2007 15:25:36 +1100 Sender: Mark_Andrews@isc.org X-Mailman-Approved-At: Sat, 10 Feb 2007 04:28:01 +0000 Subject: Re: FreeBSD Security Advisory FreeBSD-SA-07:02.bind X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Feb 2007 04:25:43 -0000 > IV. Workaround > > There is no workaround available, but systems which are not authoritative > servers for DNSSEC signed zones are not affected by the first issue; and > systems which do not permit untrusted users to perform recursive DNS > resolution are not affected by the second issue. Note that the default > configuration for named(8) in FreeBSD allows local access only (which on > many systems is equivalent to refusing access to untrusted users). More precisely, systems which do not *validate* anwers are not vulnerable to the first. All nameservers which offer recursion are vulnerable to the second. From ISC's advisary (which I authored). Workaround: Disable / restrict recursion (to limit exposure). Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org