bind9: In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 ->9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of...

In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 ->9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition,as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 developmentbranch, BIND servers are vulnerable if they are running an affected versionand are configured to use GSS-TSIG features. In a configuration which usesBIND's default settings the vulnerable code path is not exposed, but aserver can be rendered vulnerable by explicitly setting values for thetkey-gssapi-keytab or tkey-gssapi-credential configuration options.Although the default configuration is not vulnerable, GSS-TSIG isfrequently used in networks where BIND is integrated with Samba, as well asin mixed-server environments that combine BIND servers with ActiveDirectory domain controllers. For servers that meet these conditions, theISC SPNEGO implementation is vulnerable to various attacks, depending onthe CPU architecture for which BIND was built: For named binaries compiledfor 64-bit platforms, this flaw can be used to trigger a buffer over-read,leading to a server crash. For named binaries compiled for 32-bitplatforms, this flaw can be used to trigger a server crash due to a bufferoverflow and possibly also to achieve remote code execution. We havedetermined that standard SPNEGO implementations are available in the MITand Heimdal Kerberos libraries, which support a broad range of operatingsystems, rendering the ISC implementation unnecessary and obsolete.Therefore, to reduce the attack surface for BIND users, we will be removingthe ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16(it had already been dropped from BIND 9.17). We would not normally removesomething from a stable ESV (Extended Support Version) of BIND, but sincesystem libraries can replace the ISC SPNEGO implementation, we have made anexception in this case for reasons of stability and security.

Where it's fixed