From owner-freebsd-questions@FreeBSD.ORG Tue Jul 24 23:15:52 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7D61916A417; Tue, 24 Jul 2007 23:15:52 +0000 (UTC) (envelope-from jeffrey@goldmark.org) Received: from out2.smtp.messagingengine.com (out2.smtp.messagingengine.com [66.111.4.26]) by mx1.freebsd.org (Postfix) with ESMTP id 49A8013C465; Tue, 24 Jul 2007 23:15:52 +0000 (UTC) (envelope-from jeffrey@goldmark.org) Received: from compute2.internal (compute2.internal [10.202.2.42]) by out1.messagingengine.com (Postfix) with ESMTP id A1A85AA35; Tue, 24 Jul 2007 19:15:51 -0400 (EDT) Received: from heartbeat2.messagingengine.com ([10.202.2.161]) by compute2.internal (MEProxy); Tue, 24 Jul 2007 19:15:51 -0400 X-Sasl-enc: thQfmvT/ZlFU6Tmynkyhqxv9NTleuAUteGGTXESl02pH 1185318951 Received: from [10.1.10.136] (n114.ewd.goldmark.org [72.64.118.114]) by mail.messagingengine.com (Postfix) with ESMTP id 4105C112BF; Tue, 24 Jul 2007 19:15:51 -0400 (EDT) Mime-Version: 1.0 (Apple Message framework v752.2) To: FreeBSD Questions Message-Id: Content-Type: multipart/signed; micalg=sha1; boundary="Apple-Mail-6-853319599"; protocol="application/pkcs7-signature" From: Jeffrey Goldberg Date: Tue, 24 Jul 2007 18:15:43 -0500 X-Mailer: Apple Mail (2.752.2) X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: secteam@FreeBSD.org Subject: Waiting for BIND security announcement X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jul 2007 23:15:52 -0000 --Apple-Mail-6-853319599 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed [I'm cc'ing this to secteam@freebsd.org, but they are probably already aware of things. I don't require a response from them, but if they do, a posting to the questions are announcement lists would be great. I don't need a personal response.] As I'm sure many people know there is a newly discovered BIND vulnerability allowing cache injection (pharming). See http://www.isc.org/index.pl?/sw/bind/bind-security.php for details. The version of bind on 6.2, 9.3.3, looks like it is vulnerable (along with many other versions). It's not particularly an issue for me since my name servers aren't publicly queryable, but I am curios about how things like security problems in src/contrib get handled in FreeBSD. Cheers, -j -- Jeffrey Goldberg http://www.goldmark.org/jeff/ --Apple-Mail-6-853319599--