``` Exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing. The purpose of a resolver's lame cache is to ensure that if an authoritative server responds to a resolver's query in a specific broken way, subsequent client queries for the same <QNAME, QTYPE> tuple do not trigger further queries to the same server for a configurable amount of time. The lame cache is enabled by setting the lame-ttl option in named.conf to a value greater than 0. That option is set to lame-ttl 600; in the default configuration, which means the lame cache is enabled by default. Impact: Authoritative-only BIND 9 servers are NOT vulnerable to this flaw. A successful attack exploiting this flaw causes a named resolver to spend most of its CPU time on managing and checking the lame cache. This results in client queries being responded to with large delays, and increased likelihood of DNS timeouts on client hosts. ```
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4ef29a2c6d73b51b46325a4070a79d4c4daaa969 commit 4ef29a2c6d73b51b46325a4070a79d4c4daaa969 Author: Sam James <sam@gentoo.org> AuthorDate: 2021-10-28 02:01:07 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-10-28 02:01:39 +0000 net-dns/bind-tools: add 9.16.22 (security bump) Bug: https://bugs.gentoo.org/820563 Signed-off-by: Sam James <sam@gentoo.org> net-dns/bind-tools/Manifest | 1 + net-dns/bind-tools/bind-tools-9.16.22.ebuild | 148 +++++++++++++++++++++++++++ 2 files changed, 149 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7916382847660dca423c35c199bbab7f2b5576c4 commit 7916382847660dca423c35c199bbab7f2b5576c4 Author: Sam James <sam@gentoo.org> AuthorDate: 2021-10-28 01:58:50 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-10-28 02:01:38 +0000 net-dns/bind: add 9.16.22 (security bump) Bug: https://bugs.gentoo.org/820563 Signed-off-by: Sam James <sam@gentoo.org> net-dns/bind/Manifest | 1 + net-dns/bind/bind-9.16.22.ebuild | 373 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 374 insertions(+)
Please cleanup.
GLSA request filed.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8bdc575dae63f16d44b926f18271d15d3173fc5f commit 8bdc575dae63f16d44b926f18271d15d3173fc5f Author: John Helmert III <ajak@gentoo.org> AuthorDate: 2022-10-31 01:19:33 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-10-31 01:20:11 +0000 net-dns/bind: security cleanup Bug: https://bugs.gentoo.org/820563 Bug: https://bugs.gentoo.org/835439 Bug: https://bugs.gentoo.org/872206 Acked-by: Patrick McLean <chutzpah@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> net-dns/bind/Manifest | 5 - net-dns/bind/bind-9.16.27-r1.ebuild | 375 -------------------- net-dns/bind/bind-9.16.29-r1.ebuild | 376 -------------------- net-dns/bind/bind-9.16.29.ebuild | 375 -------------------- net-dns/bind/bind-9.16.30.ebuild | 381 -------------------- net-dns/bind/bind-9.16.31.ebuild | 382 --------------------- net-dns/bind/bind-9.16.32.ebuild | 382 --------------------- .../bind/files/bind-9.16.29-fortify-source-3.patch | 35 -- 8 files changed, 2311 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=3ff54f9ebabdb1f657769518402d72abd34fbdcb commit 3ff54f9ebabdb1f657769518402d72abd34fbdcb Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-10-31 01:18:02 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-10-31 01:40:16 +0000 [ GLSA 202210-25 ] ISC BIND: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/820563 Bug: https://bugs.gentoo.org/835439 Bug: https://bugs.gentoo.org/872206 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202210-25.xml | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+)
GLSA released, all done!
