BIND 9.9.8-S4 Release Notes
| Author: Michael McNally Reference Number: AA-01345 Views: 2557 Created: 2016-01-19 19:36 Last Updated: 2016-01-19 19:36
0 Rating/ Voters
BIND 9 Supported Preview edition is a feature preview version of BIND provided exclusively to eligible ISC Support customers.
This document summarizes changes since the last production release
of BIND on the corresponding major release branch.
The latest versions of BIND 9 software can always be found at
There you will find additional information about each release,
source code, and pre-compiled versions for Microsoft Windows
Named is potentially vulnerable to the OpenSSL vulnerabilty
described in CVE-2015-3193.
Incorrect reference counting could result in an INSIST
failure if a socket error occurred while performing a
lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
Insufficient testing when parsing a message allowed
records with an incorrect class to be be accepted,
triggering a REQUIRE failure when those records
were subsequently cached. This flaw is disclosed
in CVE-2015-8000. [RT #40987]
An incorrect boundary check in the OPENPGPKEY rdatatype
could trigger an assertion failure. This flaw is disclosed
in CVE-2015-5986. [RT #40286]
A buffer accounting error could trigger an assertion failure
when parsing certain malformed DNSSEC keys.
This flaw was discovered by Hanno Böck of the Fuzzing
Project, and is disclosed in CVE-2015-5722. [RT #40212]
A specially crafted query could trigger an assertion failure
This flaw was discovered by Jonathan Foote, and is disclosed
in CVE-2015-5477. [RT #40046]
On servers configured to perform DNSSEC validation, an
assertion failure could be triggered on answers from
a specially configured server.
This flaw was discovered by Breno Silveira Soares, and is
disclosed in CVE-2015-4620. [RT #39795]
Specific APL data could trigger an INSIST. This flaw
was discovered by Brian Mitchell and is disclosed in
CVE-2015-8704. [RT #41396]
fetches-per-zone options have been
updated to take an additional argument,
fail, indicating whether queries
that exceed the quota should be dropped or answered with
has been deprecated.
Statistics counters have been added to track the number
of queries spilled due to the
An --enable-querytrace configure switch is
now available to enable very verbose query tracelogging. This
option can only be set at compile time. This option has a
negative performance impact and should be used only for
The nxdomain-redirect option specifies
a DNS namespace to use for NXDOMAIN redirection. When a
recursive lookup returns NXDOMAIN, a second lookup is
initiated with the specified name appended to the query
name. This allows NXDOMAIN redirection data to be supplied
by multiple zones configured on the server or by recursive
queries to other servers. (The older method, using
a single type redirect zone, has
better average performance but is less flexible.) [RT #37989]
EDNS COOKIE options content is now displayed as
Updated the compiled in addresses for H.ROOT-SERVERS.NET.
Large inline-signing changes should be less disruptive.
Signature generation is now done incrementally; the number
of signatures to be generated in each quantum is controlled
Retrieving the local port range from net.ipv4.ip_local_port_range
on Linux is now supported.
Active Directory names of the form gc._msdcs.<forest> are
now accepted as valid hostnames when using the
check-names option. <forest> is still
restricted to letters, digits and hyphens.
Names containing rich text are now accepted as valid
hostnames in PTR records in DNS-SD reverse lookup zones,
as specified in RFC 6763. [RT #37889]
Authoritative servers that were marked as bogus (e.g. blackholed
in configuration or with invalid addresses) were being queried
anyway. [RT #41321]
Asynchronous zone loads were not handled correctly when the
zone load was already in progress; this could trigger a crash
in zt.c. [RT #37573]
A race during shutdown or reconfiguration could
cause an assertion failure in mem.c. [RT #38979]
Some answer formatting options didn't work correctly with
dig +short. [RT #39291]
Malformed records of some types, including NSAP and UNSPEC,
could trigger assertion failures when loading text zone files.
[RT #40274] [RT #40285]
Fixed a possible crash in ratelimiter.c caused by NOTIFY
messages being removed from the wrong rate limiter queue.
was inconsistently applied. [RT #40456]
BADVERS responses from broken authoritative name servers were
not handled correctly. [RT #40427]
Several bugs have been fixed in the RPZ implementation:
Policy zones that did not specifically require recursion
could be treated as if they did; consequently, setting
qname-wait-recurse no; was
sometimes ineffective. This has been corrected.
In most configurations, behavioral changes due to this
fix will not be noticeable. [RT #39229]
The server could crash if policy zones were updated (e.g.
via rndc reload or an incoming zone
transfer) while RPZ processing was still ongoing for an
active query. [RT #39415]
On servers with one or more policy zones configured as
slaves, if a policy zone updated during regular operation
(rather than at startup) using a full zone reload, such as
via AXFR, a bug could allow the RPZ summary data to fall out
of sync, potentially leading to an assertion failure in
rpz.c when further incremental updates were made to the
zone, such as via IXFR. [RT #39567]
The server could match a shorter prefix than what was
available in CLIENT-IP policy triggers, and so, an
unexpected action could be taken. This has been
corrected. [RT #39481]
The server could crash if a reload of an RPZ zone was
initiated while another reload of the same zone was
already in progress. [RT #39649]
Query names could match against the wrong policy zone
if wildcard records were present. [RT #40357]
Thank you to everyone who assisted us in making this release possible.
If you would like to contribute to ISC to assist us in continuing to
make quality open source software, please visit our donations page at
© 2001-2017 Internet Systems ConsortiumFor assistance with problems and questions for which you have not been able to find an answer in our Knowledge Base, we recommend searching our community mailing list archives and/or posting your question there (you will need to register there first for your posts to be accepted). The bind-users and the dhcp-users lists particularly have a long-standing and active membership.ISC relies on the financial support of the community to fund the development of its open source software products. If you would like to support future product evolution and maintenance as well having peace of mind knowing that our team of experts are poised to provide you with individual technical assistance whenever you call upon them, then please consider our Professional Subscription Support services - details can be found on our main website.