aboutsummaryrefslogtreecommitdiff
path: root/dns/bind94/distinfo
Commit message (Collapse)AuthorAgeFilesLines
* BIND 9.4.3-P2 is a SECURITY patch for BIND 9.4.3. It addresses a bugDoug Barton2009-03-211-6/+6
| | | | | | | | | in DNSSEC lookaside validation (DLV): unrecognized signature algorithms, which should have been treated as the equivalent of an unsigned zone, were instead treated as a validation failure. Notes: svn path=/head/; revision=230603
* Update to the -P1 versions of the current BIND ports which containDoug Barton2009-01-081-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | the fix for the following vulnerability: https://www.isc.org/node/373 Description: Return values from OpenSSL library functions EVP_VerifyFinal() and DSA_do_verify() were not checked properly. Impact: It is theoretically possible to spoof answers returned from zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6). In short, if you're not using DNSSEC to verify signatures you have nothing to worry about. While I'm here, address the issues raised in the PR by adding a knob to disable building with OpenSSL altogether (which eliminates DNSSEC capability), and fix the configure arguments to better deal with the situation where the user has ssl bits in both the base and LOCALBASE. PR: ports/126297 Submitted by: Ronald F.Guilmette <rfg@tristatelogic.com> Notes: svn path=/head/; revision=225434
* Update to version 9.4.3 which contains numerous bug fixes.Doug Barton2008-12-191-6/+6
| | | | | | | | This version also includes the use-v[46]-udp-ports options to configure a range of random UDP ports to initiate queries from. Notes: svn path=/head/; revision=224484
* All -P2 versions now have PGP signatures with ISC's standardDoug Barton2008-08-091-3/+3
| | | | | | | | | | signing key. PR: ports/126389 (for bind9) Submitted by: Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp> Notes: svn path=/head/; revision=218258
* Update to patchlevel 2 for all versions:Doug Barton2008-08-021-6/+6
| | | | | | | | | | | | | - performance improvement over the P1 releases, namely + significantly remedying the port allocation issues + allowing TCP queries and zone transfers while issuing as many outstanding UDP queries as possible + additional security of port randomization at the same level as P1 - also includes fixes for several bugs in the 9.5.0 base code Notes: svn path=/head/; revision=217934
* Upgrade to the -P1 versions of each port, which add stronger randomizationDoug Barton2008-07-091-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of the UDP query-source ports. The server will still use the same query port for the life of the process, so users for whom the issue of cache poisoning is highly significant may wish to periodically restart their server using /etc/rc.d/named restart, or other suitable method. In order to take advantage of this randomization users MUST have an appropriate firewall configuration to allow UDP queries to be sent and answers to be received on random ports; and users MUST NOT specify a port number using the query-source[-v6] option. The avoid-v[46]-udp-ports options exist for users who wish to eliminate certain port numbers from being chosen by named for this purpose. See the ARM Chatper 6 for more information. Also please note, this issue applies only to UDP query ports. A random ephemeral port is always chosen for TCP queries. This issue applies primarily to name servers whose main purpose is to resolve random queries (sometimes referred to as "caching" servers, or more properly as "resolving" servers), although even an "authoritative" name server will make some queries, primarily at startup time. This update addresses issues raised in: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 http://www.kb.cert.org/vuls/id/800113 http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience Notes: svn path=/head/; revision=216629
* Update to BIND 9.4.2. Many bugs are fixed, please see the CHANGESDoug Barton2007-12-011-6/+6
| | | | | | | | | file for more details. Approved by: portmgr (erwin) Notes: svn path=/head/; revision=202873
* Update to 9.4.1-P1, which has fixes for the following:Doug Barton2007-07-241-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Notes: svn path=/head/; revision=196229
* Update to version 9.4.1, a security update from ISC:Doug Barton2007-05-011-6/+6
| | | | | | | | | | | 2172. [bug] query_addsoa() was being called with a non zone db. [RT #16834] If you are running BIND 9.4.0 (either pre-release or final), you are advised to upgrade as soon as possible to BIND 9.4.1. Notes: svn path=/head/; revision=191246
* Update to the release version of 9.4.0.Doug Barton2007-02-261-6/+6
| | | | Notes: svn path=/head/; revision=185961
* Complete the update for bind94 after the repocopy, and hook it up.Doug Barton2007-01-281-6/+6
| | | | Notes: svn path=/head/; revision=183578
* Upgrade to version 9.3.4, the latest from ISC, which addresses theDoug Barton2007-01-251-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | following security issues. All users of BIND are encouraged to upgrade to this version. 2126. [security] Serialise validation of type ANY responses. [RT #16555] 2124. [security] It was possible to dereference a freed fetch context. [RT #16584] 2089. [security] Raise the minimum safe OpenSSL versions to OpenSSL 0.9.7l and OpenSSL 0.9.8d. Versions prior to these have known security flaws which are (potentially) exploitable in named. [RT #16391] 2088. [security] Change the default RSA exponent from 3 to 65537. [RT #16391] 2066. [security] Handle SIG queries gracefully. [RT #16300] 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] Notes: svn path=/head/; revision=183229
* Upgrade to version 9.3.3, the latest from ISC. This isDoug Barton2006-12-091-6/+6
| | | | | | | | | | | a maintenance release, with the usual round of bug and security fixes. All users of BIND 9 are encouraged to upgrade to this version. Notes: svn path=/head/; revision=179339
* Update to version 9.3.2-P2, which addresses the vulnerabilityDoug Barton2006-11-031-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | announced by ISC dated 31 October (delivered via e-mail to the bind-announce@isc.org list today): Description: Because of OpenSSL's recently announced vulnerabilities (CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named, we are announcing this workaround and releasing patches. A proof of concept attack on OpenSSL has been demonstrated for CAN-2006-4339. OpenSSL is required to use DNSSEC with BIND. Fix for version 9.3.2-P1 and lower: Upgrade to BIND 9.2.3-P2, then generate new RSASHA1 and RSAMD5 keys for all old keys using the old default exponent and perform a key rollover to these new keys. These versions also change the default RSA exponent to be 65537 which is not vulnerable to the attacks described in CAN-2006-4339. Notes: svn path=/head/; revision=176257
* Upgrade to version 9.3.2-P1, which addresses the following securityDoug Barton2006-09-061-6/+6
| | | | | | | | | | | | | | | | vulnerabilities: http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en 2066. [security] Handle SIG queries gracefully. [RT #16300] http://www.kb.cert.org/vuls/id/697164 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] All users of BIND 9 are encouraged to upgrade to this version. Notes: svn path=/head/; revision=172416
* Update to 9.3.2, the latest from ISCDoug Barton2005-12-281-6/+6
| | | | Notes: svn path=/head/; revision=152247
* Add SHA256 checksums to my portsDoug Barton2005-11-241-0/+2
| | | | Notes: svn path=/head/; revision=149230
* Upgrade to 9.3.1, the latest version from ISC. This version containsDoug Barton2005-03-131-8/+4
| | | | | | | | | | | | | | | | | | | | | several important fixes, including a remote (although unlikely) exploit. See the CHANGES file for details. All users of BIND 9 are highly encouraged to upgrade to this version. Changes to the port include: 1. Remove ISC patch to 9.3.0 that addressed the remote exploit 2. Change to OPTIONS, and thereby 3. --enable-threads is now the default. Users report that the new thread code in 9.3.x works significantly better than the old on all versions of FreeBSD. 4. Add a temporary shim for the old PORT_REPLACES_BASE_BIND9 option. The OPTIONS framework requires knobs to start with WITH_ or WITHOUT_ 5. Remove patch that shoehorned named.conf.5 into the right place, it has been fixed in the code. Notes: svn path=/head/; revision=131083
* Include a patch from ISC to deal with the following vulnerability:Doug Barton2005-01-281-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Name: BIND: Self Check Failing [Added 2005.25.01] Versions affected: BIND 9.3.0 Severity: LOW Exploitable: Remotely Type: Denial of Service Description: An incorrect assumption in the validator (authvalidated) can result in a REQUIRE (internal consistancy) test failing and named exiting. Workarounds: Turn off dnssec validation (off by default) at the options/view level. dnssec-enable no; Active Exploits: None known Bump PORTREVISION accordingly. It should be noted that the vast majority of users would not have DNSSEC enabled, and therefore are not vulnerable to this bug. Notes: svn path=/head/; revision=127562
* Update to BIND 9.3.0, the latest from ISC. This version has severalDoug Barton2004-09-241-2/+4
| | | | | | | | | | | | | | | | | | | significant updates, not the least of which is the new and improved DNSSEC code based on the latest standards (including DS). Various updates to the port, including: 1. Download the PGP signature 2. If running on ${OSVERSION} >= 503000, configure with threads 3. Update pkg-descr re IPv6 RRs 4. Update pkg-message to reflect a world with 6-current There is also a patch to correct a man page installation error. This problem should be fixed in the next release. Approved by: portmgr (marcus) Notes: svn path=/head/; revision=118366
* Now that the SIZE thing has stabilized, add it to the ports I maintain.Doug Barton2004-03-141-0/+1
| | | | Notes: svn path=/head/; revision=103917
* Upgrade to the 9.2.3 release versionDoug Barton2003-10-241-1/+1
| | | | Notes: svn path=/head/; revision=92089
* Upgrade to version 9.2.3rc4.Doug Barton2003-09-251-1/+1
| | | | | | | | | | | The 9.2.3 code has many many bugs fixed from 9.2.2, check CHANGES for more information. The rc4 code has the delegation-only options. Check the ARM for information on how to enable it. Notes: svn path=/head/; revision=89298
* * Update to version 9.2.2, the latest from ISC. This version contains noDoug Barton2003-03-041-1/+1
| | | | | | | | | | new features compared to 9.2.1, only bug fixes. Users of BIND 9 are highly encouraged to upgrade. * Switch to Makefile COMMENT Notes: svn path=/head/; revision=76841
* Upgrade to 9.2.2rc1. This version has been available for several months, andDoug Barton2003-01-261-1/+1
| | | | | | | | | | | | is widely considered to be more stable than 9.2.1. I would have preferred a -REL version, but better is better. * Clean up the Makefile a little * Just say no to threads * Add the PORT_REPLACES_BASE magic, similar to the bind8 port Notes: svn path=/head/; revision=74024
* Update to the latest release versionDoug Barton2002-05-221-1/+1
| | | | Notes: svn path=/head/; revision=59668
* Upgrade to 9.2.1rc2, the latest from ISC. Numerous bugs were fixed,Doug Barton2002-04-081-1/+1
| | | | | | | see /usr/local/share/doc/bind9/CHANGES after installation for details. Notes: svn path=/head/; revision=57425
* Upgrade to the latest release candidate, 9.2.1rc1. Numerous 9.x bugsDoug Barton2002-03-171-1/+1
| | | | | | | | | | | | | are fixed in this version, however BIND 9 is still recommended only for early adopters, and those that have time to closely monitor their name service. * Change PORTNAME to bind9 so that 'pkg_add -r bind' does the right thing * Use the local version of openssl, and disable threads on all but the most recent -current. Thread support is still considered experimental. Notes: svn path=/head/; revision=56237
* Update port version to ISC's latest stable releaseDoug Barton2001-07-241-1/+1
| | | | Notes: svn path=/head/; revision=45450
* Upgrade to 9.1.3rc1, whose most significant change is a fix forDoug Barton2001-05-281-1/+1
| | | | | | | some IXFR problems. Notes: svn path=/head/; revision=43178
* Upgrade to BIND 9.1.2-Release. There is no newe functionality, butDoug Barton2001-05-091-1/+1
| | | | | | | | it is highly recommended that all users of BIND 9 upgrade to this maintenance release. Notes: svn path=/head/; revision=42437
* Update to the actual release version of 9.1.1. If you're usingDoug Barton2001-04-031-1/+1
| | | | | | | bind 9, upgrade to this version. Notes: svn path=/head/; revision=40791
* Latest bug fixes, FOR GREAT JUSTICE !!Doug Barton2001-03-271-1/+1
| | | | Notes: svn path=/head/; revision=40427
* Latest bug fixes and documentation updates.Doug Barton2001-03-231-1/+1
| | | | Notes: svn path=/head/; revision=40274
* Latest bug fixes, no features added.Doug Barton2001-03-191-1/+1
| | | | Notes: svn path=/head/; revision=40039
* Upgrade to ISC's latest. No new features, but a few useful bug fixes.Doug Barton2001-03-101-1/+1
| | | | Notes: svn path=/head/; revision=39470
* Update to ISC's latestDoug Barton2001-02-271-1/+1
| | | | Notes: svn path=/head/; revision=38843
* Latest update from ISC. Truly just bugfixes.Doug Barton2001-02-131-1/+1
| | | | Notes: svn path=/head/; revision=38295
* Update to ISC's bug fix release. For those who wish to (or need to)Doug Barton2001-02-081-1/+1
| | | | | | | use BIND 9 this upgrade is highly recommended. Notes: svn path=/head/; revision=38093
* Update to 9.1.0; replace Makefile.in patch with perl regex.Will Andrews2001-01-211-1/+1
| | | | | | | Requested by: Joong Hyun Kim <better@ns1.betterbox.net> Notes: svn path=/head/; revision=37382
* Update to 9.0.1Doug Barton2000-11-191-1/+1
| | | | | | | | PR: ports/22941 Submitted by: Leif Neland, leifn@neland.dk Notes: svn path=/head/; revision=35266
* Update to BIND version 9.0.0, now with better DNSSEC support among lotsWill Andrews2000-10-291-0/+1
| | | | | | | | | of other neat things like that. Sorry for the delay. Repo-copy by: asami Notes: svn path=/head/; revision=34384
* Temporarily remove bind9, it is a repo-copy from bind8 not updated.Satoshi Asami2000-10-211-2/+0
| | | | | | | | The history is safe, so just "cvs add" the files back when bind9 is ready to be committed. Notes: svn path=/head/; revision=34088
* Upgrade to 8.2.2 patch 5Justin M. Seger1999-11-151-3/+2
| | | | Notes: svn path=/head/; revision=23130
* Upgrade to bind-8.2.2.p3 + patch4. Fixes some security issues.Justin M. Seger1999-11-121-2/+3
| | | | | | | | Many people submitted patches for this one, and a combination of them were used. Notes: svn path=/head/; revision=23039
* Upgrade to bind 8.2.1Justin M. Seger1999-08-081-3/+2
| | | | | | | | Submitted by: ust@cert.siemens.de PR: ports/12875 Notes: svn path=/head/; revision=20619
* Bring back bind8, even -CURRENT only has 8.1.2, this port is more up-to-date.Bill Fumerola1999-06-281-0/+3
| | | | | | | Requested By: a bazillion people both on mailing lists and #FreeBSD. Notes: svn path=/head/; revision=19881
* Nuke bind8, it's been in the base system for a while now.Justin M. Seger1999-06-251-3/+0
| | | | Notes: svn path=/head/; revision=19770
* Use latest patches from ISC.Justin M. Seger1999-05-311-0/+1
| | | | | | | PR: ports/11784 Notes: svn path=/head/; revision=19154
* Upgrade to bind 8.2Justin M. Seger1999-04-041-2/+2
| | | | | | | | Submitted by: Brad Hendrickse <bradh@uunet.co.za> PR: ports/10861 Notes: svn path=/head/; revision=17631
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-11 11:31:03 +0000