BIND 9.9.8b1 Release Notes
| Author: Michael McNally Reference Number: AA-01288 Views: 10868 Created: 2015-08-06 21:09 Last Updated: 2015-08-06 21:14
0 Rating/ Voters
This document summarizes changes since the last production release
of BIND on the corresponding major release branch.
The latest versions of BIND 9 software can always be found at
There you will find additional information about each release,
source code, and pre-compiled versions for Microsoft Windows
A specially crafted query could trigger an assertion failure
This flaw was discovered by Jonathan Foote, and is disclosed
in CVE-2015-5477. [RT #39795]
On servers configured to perform DNSSEC validation, an
assertion failure could be triggered on answers from
a specially configured server.
This flaw was discovered by Breno Silveira Soares, and is
disclosed in CVE-2015-4620. [RT #39795]
New quotas have been added to limit the queries that are
sent by recursive resolvers to authoritative servers
experiencing denial-of-service attacks. When configured,
these options can both reduce the harm done to authoritative
servers and also avoid the resource exhaustion that can be
experienced by recursives when they are being used as a
vehicle for such an attack.
NOTE: These options are not available by default; use
configure --enable-fetchlimit to include
them in the build.
fetches-per-server limits the number of
simultaneous queries that can be sent to any single
authoritative server. The configured value is a starting
point; it is automatically adjusted downward if the server is
partially or completely non-responsive. The algorithm used to
adjust the quota can be configured via the
fetches-per-zone limits the number of
simultaneous queries that can be sent for names within a
single domain. (Note: Unlike "fetches-per-server", this
value is not self-tuning.)
Statistics counters have also been added to track the number
of queries affected by these quotas.
An --enable-querytrace configure switch is
now available to enable very verbose query tracelogging. This
option can only be set at compile time. This option has a
negative performance impact and should be used only for
EDNS COOKIE options content is now displayed as
Large inline-signing changes should be less disruptive.
Signature generation is now done incrementally; the number
of signatures to be generated in each quantum is controlled
Retrieving the local port range from net.ipv4.ip_local_port_range
on Linux is now supported.
Asynchronous zone loads were not handled correctly when the
zone load was already in progress; this could trigger a crash
in zt.c. [RT #37573]
A race during shutdown or reconfiguration could
cause an assertion failure in mem.c. [RT #38979]
Some answer formatting options didn't work correctly with
dig +short. [RT #39291]
Thank you to everyone who assisted us in making this release possible.
If you would like to contribute to ISC to assist us in continuing to
make quality open source software, please visit our donations page at
© 2001-2016 Internet Systems ConsortiumPlease help us to improve the content of our knowledge base by letting us know below how we can improve this article. If you have a technical question or problem on which you'd like help, please don't submit it here as article feedback. For assistance with problems and questions for which you have not been able to find an answer in our Knowledge Base, we recommend searching our community mailing list archives and/or posting your question there (you will need to register there first for your posts to be accepted). The bind-users and the dhcp-users lists particularly have a long-standing and active membership.ISC relies on the financial support of the community to fund the development of its open source software products. If you would like to support future product evolution and maintenance as well having peace of mind knowing that our team of experts are poised to provide you with individual technical assistance whenever you call upon them, then please consider our Professional Subscription Support services - details can be found on our main website.