<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 2009-12-10 08:49, Niobos wrote:
<blockquote
cite="mid:DB5C4B5A-D7A4-43BD-B0B6-E8CD57AE8811@dest-unreach.be"
type="cite">
<pre wrap="">Thank you very much for your help; I'll forward the conversation to the bug-tracking list.
Since these are my first DNSSEC experiments, I just wanted to make sure that it wasn't a problem with my understanding of the concept.
Niobos
</pre>
</blockquote>
<br>
<div>This has been confirmed as a security-bug by ISC a while back. Due
to the potential exploit, they asked me not to release this information
until the fix was released.</div>
<div><br>
</div>
<div>BIND 9.6.1-P3 now contains the fix:</div>
<div>827.<span class="Apple-tab-span" style="white-space: pre;"> </span>[security]<span
class="Apple-tab-span" style="white-space: pre;"> </span>Bogus
NXDOMAIN could be cached as if valid. [RT #20712]</div>
<div><br>
I can confirm that this version behaves as expected: keeps returning
SERVFAIL on bogus NXDOMAIN response.<br>
<br>
</div>
<div>Niobos</div>
</body>
</html>