-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 02/16/2011 06:07, Eric_vanGyzen@McAfee.com wrote:
| The release notes for BIND 9.7.3 contain this:
|
| * A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled
| allows for a TCP DoS attack. Until there is a kernel fix, ISC is
| disabling SO_ACCEPTFILTER support in BIND. [RT #22589]
|
| The CHANGES file also says:
|
| 2996. [security] Temporarily disable SO_ACCEPTFILTER support.
| [RT #22589]
|
| Can anyone tell me more? What releases are affected? Is a kernel
patch in the works?
The SO_ACCEPTFILTER feature is off by default for DNS in FreeBSD, so if
you have not enabled it specifically, you're all set. :) If you have it
enabled my suggestion is that you disable it.
That said, the details of the issue are in the capable hands of the
security officer team, so I will defer to them for further comment at
the appropriate time. Meanwhile, you can safely deduce from the fact
that we have not been blaring the trumpets from the rooftops about this
issue that it is a fairly minor one.
hope this helps,
Doug
- --
Nothin' ever doesn't change, but nothin' changes much.
-- OK Go
Breadth of IT experience, and depth of knowledge in the DNS.
Yours for the right price. :) http://SupersetSolutions.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (FreeBSD)
iQEcBAEBCAAGBQJNXDpVAAoJEFzGhvEaGryE8CYH/AyW1tJNhFNS3alUFGiux8u3
6jxX74qNzM5xcB1Z+0Nq9ydAXWBl36WJJRnQ+SunQSeD2dKPt79OmaHAf2oNC4P6
DaCE+dbJ7tTLH6XlGSEPawmcSY28uhKvbi39G9sz74GamZOxB2+GuUOlH4lXXF7x
EvNV/0KCCeZ2jCvquZEPFG7fDOYhjHtpAeGKSjYysxhsxSHCKoscklGRG9prGu3t
kF/aEGeGPTva5G/IlHZqppdSjeaRgMUIpfFgmOtUeBvkmn9wAF2BVKrc+d+pK31y
hPFBCWtHEJ4MMoAPyQezgCkliCUx7ufw+ns/TQANE9fRhrmh6OClQZW8NE8Zoew=IXOE
-----END PGP SIGNATURE-----