<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">
<blockquote type="cite">
<table class="header-part1" border="0" cellpadding="0"
cellspacing="0" width="100%">
<tbody>
<tr>
<td>
<div class="headerdisplayname" style="display:inline;">Subject:
</div>
Install BIND 9.9.7-P2 to fix vulnerability CVE-2015-5477</td>
</tr>
<tr>
<td>
<div class="headerdisplayname" style="display:inline;">From:
</div>
stavrostseriotis <a class="moz-txt-link-rfc2396E" href="mailto:StavrosTseriotis@semltd.com.cy"><StavrosTseriotis@semltd.com.cy></a></td>
</tr>
<tr>
<td>
<div class="headerdisplayname" style="display:inline;">Date:
</div>
07-Sep-15 05:24</td>
</tr>
</tbody>
</table>
<table class="header-part2" border="0" cellpadding="0"
cellspacing="0" width="100%">
<tbody>
<tr>
<td>
<div class="headerdisplayname" style="display:inline;">To:
</div>
<a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a></td>
</tr>
</tbody>
</table>
<br>
<p class="MsoNormal"><span lang="EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have a RedHat 5.11
machine and currently I am facing the issue with BIND
vulnerability CVE-2015-5477. I cannot update my BIND using
yum because I didn’t install BIND from RedHat at the first
place so I need to do it manually.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I downloaded the package
of version 9.9.7-P2 from isc website but since it is not an
rpm file I have to build it myself.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I followed the
instructions I found on website <a
href="https://deepthought.isc.org/article/AA-00768/0/Getting-started-with-BIND-ho"><a class="moz-txt-link-freetext" href="https://deepthought.isc.org/article/AA-00768/0/Getting-started-with-BIND-ho">https://deepthought.isc.org/article/AA-00768/0/Getting-started-with-BIND-ho</a></a>
but it does not change the version of bind. I don’t know
what I am doing wrong.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I am wondering if you
can give me a little guideline on how to build and install
the new version.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thank you<o:p></o:p></span></p>
<span lang="EN-US"><o:p></o:p></span></blockquote>
"does not change the version of bind" - as reported how? By named
-V? Or by a DNS query to version.bind CH TXT?<br>
<br>
If the former, you probably have more than one named executable -
with the old one earlier in your PATH. "which named" should
help. If the latter, did you remember to restart named? And did
the restart succeed? And does your startup process have the same
PATH as your terminal? (Often they do not.)<br>
<br>
Re-read the instructions - and pay special attention to how you
run configure. The default is to build/install in /usr/local/*bin
- which is not the default for most distributions' startup files.<br>
<br>
I strongly recommend keeping track of each step as you build (a
big scrollback buffer helps). Either write your own instructions,
or turn it into a script. There are enough steps that it's easy
to make a mistake - and you will be re-building bind again to
upgrade. Plus, if you ask for help, you will be able to provide
the details of what you did. Without details of what you did and
what you see, people can't provide specific help.<br>
<br>
Note that RedHat usually has a number of patches (often for
SeLinux and systemd) that you won't get if you build yourself from
ISC sources. <br>
<br>
Or remove bind and switch to the RedHat version. You're paying
RedHat to do the maintenance, so unless you have local patches or
very special requirements, you might as well let them do the
work. <br>
<br>
Typically, if you really need the latest from ISC on RedHat you're
better off getting the SRC RPM from RedHat & modifying the
rpmbuild config file to fetch the latest ISC source, then build
RPMs. If you stay with the same ISC code stream, you won't have
too many patch conflicts to resolve. After you've done this once
or twice, you'll want to revisit you need for local changes -
either decide they're not that important, or offer them to ISC.
Maintaining a private version is work.<br>
<br>
<pre class="moz-signature" cols="72">Timothe Litt
ACM Distinguished Engineer
--------------------------
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed.
</pre>
<br>
</div>
<br>
</body>
</html>