oss-sec mailing list archives
Re: BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination
From: Michael McNally <mcnally () isc org>
Date: Thu, 18 Feb 2021 23:26:44 -0900
On 2/18/21 11:17 PM, Hanno Böck wrote:
On Thu, 18 Feb 2021 20:09:47 -0900 ISC Security Officer <security-officer () isc org> wrote:2) If you already have packages based on 9.16.12, we expect to have a patch ready well before the next maintenance release. A candidate patch is under review now and can be delivered after review and quality assurance testing. If you wish to receive updates on the progress of this patch, please e-mail your request to security-officer () isc orgI am confused by your actions here. You warn people about a messed up release (can happen, no problem), you say you have a preliminary patch, but you make it extra complicated to get that patch? Why not just post the patch?
In brief: - the flawed releases were issued yesterday - this morning the first customer reported the crash to us - we isolated the root cause of the reported crash a short time after that - we have written a candidate patch, but it has not yet been reviewed or put through our QA process. I think people here will not fault us for being understandably gun-shy about compounding our error further. We certainly don't want to make it more complicated than necessary to obtain a patch, once we have one we are satisfied will safely correct the problem without introducing other issues, but we don't have that at this moment in time. However, we were concerned that packagers would very likely be scrambling to issue updated patches which correct the CVE we also disclosed yesterday, if they had not already prepared them in advance. So we thought it was imperative to announce the issue ASAP, even while we work on reviewing and testing the candidate patch. All the same, we know that there will be interest in a patch, so we encourage people to request it now and it will be delivered when we are satisfied we have screened it properly. I hope that explains our actions better. We've been scrambling to deal with this and don't have everything perfectly lined up but we wanted to be transparent and not compound the problem by sitting on information until we had everything neatly tied up. Michael McNally (for ISC Security Officer)
Current thread:
- BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination ISC Security Officer (Feb 19)
- Re: BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination Hanno Böck (Feb 19)
- Re: BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination Michael McNally (Feb 19)
- Re: BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination Ondřej Surý (Feb 19)
- Re: BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination Hanno Böck (Feb 19)