<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Thanks Cathy.<br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Cathy Almond <cathya@isc.org><br>
<b>Sent:</b> Monday, March 5, 2018 11:53:44 AM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: servfail-ttl 0; option in the named.conf global section is crashing the named (BIND 9.10.6)</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 05/03/2018 05:50, Nagesh Thati wrote:<br>
> Hello,<br>
> <br>
> I have added a servfail-ttl 0; parameter in the named.conf file in the<br>
> global section and restarted the named, but named is not coming up and I<br>
> don't see any errors printing in the named.log. When I do a<br>
> named-checkconf on named.conf it is giving error as UNKNOWN OPTION<br>
> servfail-ttl. The version I am using is BIND 9.10.6 stable build. Can<br>
> some one help me on this. <br>
> Thanks.<br>
> <br>
> To fix this bug I have added above parameter CVE-2018-5734: A<br>
> malformed request can trigger an assertion failure in badcache.c<br>
> <<a href="https://kb.isc.org/article/AA-01562/0/CVE-2018-5734%3A-A-malformed-request-can-trigger-an-assertion-failure-in-badcache.c.html">https://kb.isc.org/article/AA-01562/0/CVE-2018-5734%3A-A-malformed-request-can-trigger-an-assertion-failure-in-badcache.c.html</a>><br>
<br>
CVE-2018-5734 affects only the editions listed in the security advisory:<br>
<br>
9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, and 9.10.6-S2<br>
<br>
These are Supported Preview Editions of BIND provided to eligible ISC<br>
Support customers, not the same as the ones available for download from<br>
our website.<br>
<br>
Servfail cache was added to BIND Open Source from BIND 9.11 (although it<br>
was backported to some of the -S editions as a Supported Preview<br>
feature) - see:<br>
<a href="https://kb.isc.org/article/AA-01310/109/BIND9-Significant-Features-Matrix.html">https://kb.isc.org/article/AA-01310/109/BIND9-Significant-Features-Matrix.html</a><br>
<br>
This is why the servfail-ttl option is unknown in 9.10.6.<br>
<br>
So you're not vulnerable to CVE-2018-5734 - although I see why you might<br>
have thought that you are because the -S editions of BIND have a similar<br>
version numbering scheme to the regular editions, but with -S appended<br>
(it's not often that we have a security issue that affects only those,<br>
but it is still necessary to issue an advisory).<br>
<br>
Hope this clarifies (and also sets your mind at rest)?<br>
<br>
Cathy<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font></div>
</body>
</html>