<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0mm;
mso-margin-bottom-alt:auto;
margin-left:0mm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.18
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="JA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Does “a successful IXFR transfer” include “AXFR-style IXFR” ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">T. Matsumoto<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0mm 0mm 0mm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> bind-users-bounces+tmatsumo=yahoo-corp.jp@lists.isc.org
[mailto:bind-users-bounces+tmatsumo=yahoo-corp.jp@lists.isc.org] <b>On Behalf Of
</b>Larissa Shapiro<br>
<b>Sent:</b> Wednesday, February 23, 2011 5:56 AM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Security Advisory: Server Lockup Upon IXFR or DDNS Update Combined with High Query Rate<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p><span lang="EN-US"> Internet Systems Consortium Security Advisory
<o:p></o:p></span></p>
<p><span lang="EN-US">Title: Server Lockup Upon IXFR or DDNS Update Combined with High Query Rate<o:p></o:p></span></p>
<p><span lang="EN-US">(<a href="http://www.isc.org/software/bind/advisories/cve-2011-0414">http://www.isc.org/software/bind/advisories/cve-2011-0414</a>)<o:p></o:p></span></p>
<p><span lang="EN-US">CVE-2011-0414 <o:p></o:p></span></p>
<p><span lang="EN-US">VU#559980 <o:p></o:p></span></p>
<p><span lang="EN-US">CVSS: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C) <br>
for more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit:
<a href="http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2" target="_top">http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2</a>
<o:p></o:p></span></p>
<p><span lang="EN-US">Posting date: 2011-02-22 <o:p></o:p></span></p>
<p><span lang="EN-US">Program Impacted: BIND <o:p></o:p></span></p>
<p><span lang="EN-US">Versions affected: 9.7.1-9.7.2-P3 <o:p></o:p></span></p>
<p><span lang="EN-US">Severity: High <o:p></o:p></span></p>
<p><span lang="EN-US">Exploitable: Remotely <o:p></o:p></span></p>
<p><span lang="EN-US">Description and Impact: <o:p></o:p></span></p>
<p><span lang="EN-US">When an authoritative server processes a successful IXFR transfer or a dynamic update, there is a small window of time during which the IXFR/update coupled with a query may cause a deadlock to occur. This deadlock will cause the server
to stop processing all requests. A high query rate and/or a high update rate will increase the probability of this condition.
<o:p></o:p></span></p>
<p><span lang="EN-US">Workaround: <o:p></o:p></span></p>
<p><span lang="EN-US">Depending on your performance requirements, a work-around may be available. ISC was not able to reproduce this defect in 9.7.2 using -n 1, which causes named to use only one worker thread, thus avoiding the deadlock. If your server is
powerful enough to serve your data with a single processor, this option may be fast to implement until you have time to perform an upgrade.
<o:p></o:p></span></p>
<p><span lang="EN-US">Active exploits: None known, but a description of the issue is available in the release notes for BIND 9.6.3 and 9.7.3.
<o:p></o:p></span></p>
<p><span lang="EN-US">Solution: If you run BIND 9.7.1 or 9.7.2, upgrade to BIND 9.7.3. Earlier versions are not vulnerable. If you run BIND 9.6.x, 9.6-ESV-R?, or 9.4-ESV-R4, you do not need to upgrade. BIND 9.5 is End of Life and is not supported by ISC. BIND
9.8 is not vulnerable. <o:p></o:p></span></p>
<p><span lang="EN-US">Credits: Thank you to Neustar for finding the initial defect and JPRS for further testing and analysis.
<o:p></o:p></span></p>
<p><span lang="EN-US">Questions regarding this advisory or ISC's Support services should be sent to
<a href="mailto:bind9-bugs@isc.org">bind9-bugs@isc.org</a><br>
For more information on ISC's support, consulting, training, and other services, visit
<br>
<a href="http://www.isc.org/community/blog/201102/open-source-software-unsupported-isnt-it">http://www.isc.org/community/blog/201102/open-source-software-unsupported-isnt-it</a><o:p></o:p></span></p>
</div>
</body>
</html>