Release Notes for BIND Version 9.12.4rc1

Introduction

   This document summarizes changes since the last production release on
   the BIND 9.12 branch. Please see the CHANGES for a further list of bug
   fixes and other changes.

Download

   The latest versions of BIND 9 software can always be found at
   http://www.isc.org/downloads/. There you will find additional
   information about each release, source code, and pre-compiled versions
   for Microsoft Windows operating systems.

Security Fixes

     * named could crash during recursive processing of DNAME records when
       deny-answer-aliases was in use. This flaw is disclosed in
       CVE-2018-5740. [GL #387]
     * When recursion is enabled but the allow-recursion and
       allow-query-cache ACLs are not specified, they should be limited to
       local networks, but they were inadvertently set to match the
       default allow-query, thus allowing remote queries. This flaw is
       disclosed in CVE-2018-5738. [GL #309]
     * The serve-stale feature could cause an assertion failure in rbtdb.c
       even when stale-answer-enable was false. The simultaneous use of
       stale cache records and NSEC aggressive negative caching could
       trigger a recursion loop in the named process. This flaw is
       disclosed in CVE-2018-5737. [GL #185]
     * A bug in zone database reference counting could lead to a crash
       when multiple versions of a slave zone were transferred from a
       master in close succession. This flaw is disclosed in
       CVE-2018-5736. [GL #134]
     * Code change #4964, intended to prevent double signatures when
       deleting an inactive zone DNSKEY in some situations, introduced a
       new problem during zone processing in which some delegation glue
       RRsets are incorrectly identified as needing RRSIGs, which are then
       created for them using the current active ZSK for the zone. In
       some, but not all cases, the newly-signed RRsets are added to the
       zone's NSEC/NSEC3 chain, but incompletely -- this can result in a
       broken chain, affecting validation of proof of nonexistence for
       records in the zone. [GL #771]
     * named could crash if it managed a DNSSEC security root with
       managed-keys and the authoritative zone rolled the key to an
       algorithm not supported by BIND 9. This flaw is disclosed in
       CVE-2018-5745. [GL #780]
     * named leaked memory when processing a request with multiple Key Tag
       EDNS options present. ISC would like to thank Toshifumi Sakaguchi
       for bringing this to our attention. This flaw is disclosed in
       CVE-2018-5744. [GL #772]
     * Zone transfer controls for writable DLZ zones were not effective as
       the allowzonexfr method was not being called for such zones. This
       flaw is disclosed in CVE-2019-6465. [GL #790]

New Features

     * update-policy rules that otherwise ignore the name field now
       require that it be set to "." to ensure that any type list present
       is properly interpreted. Previously, if the name field was omitted
       from the rule declaration but a type list was present, it wouldn't
       be interpreted as expected.
     * named now supports the "root key sentinel" mechanism. This enables
       validating resolvers to indicate which trust anchors are configured
       for the root, so that information about root key rollover status
       can be gathered. To disable this feature, add root-key-sentinel no;
       to named.conf. [GL #37]
     * Add the ability to not return a DNS COOKIE option when one is
       present in the request. To prevent a cookie being returned add
       answer-cookie no; to named.conf. [GL #173]
       answer-cookie no is only intended as a temporary measure, for use
       when named shares an IP address with other servers that do not yet
       support DNS COOKIE. A mismatch between servers on the same address
       is not expected to cause operational problems, but the option to
       disable COOKIE responses so that all servers have the same behavior
       is provided out of an abundance of caution. DNS COOKIE is an
       important security mechanism, and should not be disabled unless
       absolutely necessary.
     * Two new update policy rule types have been added krb5-selfsub and
       ms-selfsub which allow machines with Kerberos principals to update
       the name space at or below the machine names identified in the
       respective principals.
     * The new configure option --enable-fips-mode can be used to make
       BIND enable and enforce FIPS mode in the OpenSSL library. When
       compiled with such option the BIND will refuse to run if FIPS mode
       can't be enabled, thus this option must be only enabled for the
       systems where FIPS mode is available.

Feature Changes

     * BIND now can be compiled against libidn2 library to add IDNA2008
       support. Previously BIND only supported IDNA2003 using (now
       obsolete) idnkit-1 library.
     * dig +noidnin can be used to disable IDN processing on the input
       domain name, when BIND is compiled with IDN support.
     * The rndc nta command could not differentiate between views of the
       same name but different class; this has been corrected with the
       addition of a -class option. [GL #105]
     * When compiled with IDN support, the dig and the nslookup commands
       now disable IDN processing when the standard output is not a tty
       (e.g. not used by human). The command line options +idnin and
       +idnout need to be used to enable IDN processing when dig or
       nslookup is used from the shell scripts.

Bug Fixes

     * When a negative trust anchor was added to multiple views using rndc
       nta, the text returned via rndc was incorrectly truncated after the
       first line, making it appear that only one NTA had been added. This
       has been fixed. [GL #105]
     * named now rejects excessively large incremental (IXFR) zone
       transfers in order to prevent possible corruption of journal files
       which could cause named to abort when loading zones. [GL #339]

License

   BIND is open source software licenced under the terms of the Mozilla
   Public License, version 2.0 (see the LICENSE file for the full text).

   The license requires that if you make changes to BIND and distribute
   them outside your organization, those changes must be published under
   the same license. It does not require that you publish or disclose
   anything other than the changes you have made to our software. This
   requirement does not affect anyone who is using BIND, with or without
   modifications, without redistributing it, nor anyone redistributing
   BIND without changes.

   Those wishing to discuss license compliance may contact ISC at
   https://www.isc.org/mission/contact/.

End of Life

   The end-of-life date for BIND 9.12 has not yet been determined.
   However, it is not intended to be an Extended Support Version (ESV)
   branch; accordingly, support will end after the next stable branch
   (9.14) becomes available. Those needing a longer-lived branch are
   encouraged to use the current ESV, BIND 9.11, which will be supported
   until December 2021. See
   https://www.isc.org/downloads/software-support-policy/ for details of
   ISC's software support policy.

Thank You

   Thank you to everyone who assisted us in making this release possible.
   If you would like to contribute to ISC to assist us in continuing to
   make quality open source software, please visit our donations page at
   http://www.isc.org/donate/.