notbugAs an Amazon Associate I earn from qualifying purchases.
Want a good read? Try FreeBSD Mastery: Jails (IT Mastery Book 15)

Two new features

Two new features were added on 2020-05-30:
  1. Repology links - each port now has a link to See issue 148 for details.
  2. Ports I maintain report - port maintainers can now subscribe to a daily report of commits to the ports they maintain. See Watch ports I maintain at Report Subscriptions. Details at issue 138
non port: dns/bind97/distinfo

Number of commits found XX: 23

Fri, 19 Oct 2012
[ 09:31 erwin ] Original commit   Revision:306111
306111 dns/bind97/Makefile
306111 dns/bind97/distinfo
Update to 9.7.7

Feature safe:	yes
Wed, 10 Oct 2012
[ 11:54 erwin ] Original commit   Revision:305645
305645 dns/bind96/Makefile
305645 dns/bind96/distinfo
305645 dns/bind97/Makefile
305645 dns/bind97/distinfo
305645 dns/bind98/Makefile
305645 dns/bind98/distinfo
305645 dns/bind99/Makefile
305645 dns/bind99/distinfo
305645 security/vuxml/vuln.xml
Upgrade to the latest BIND patch level:

A deliberately constructed combination of records could cause named
to hang while populating the additional section of a response.

Wed, 19 Sep 2012
[ 03:46 dougb ] Original commit   Revision:304476
304476 dns/bind96/Makefile
304476 dns/bind96/distinfo
304476 dns/bind97/Makefile
304476 dns/bind97/distinfo
304476 dns/bind98/Makefile
304476 dns/bind98/distinfo
304476 dns/bind99/Makefile
304476 dns/bind99/distinfo
304476 security/vuxml/vuln.xml
Upgrade to the latest BIND patch level:

Prevents a crash when queried for a record whose RDATA exceeds
65535 bytes.

Prevents a crash when validating caused by using "Bad cache" data
before it has been initialized.

ISC_QUEUE handling for recursive clients was updated to address
a race condition that could cause a memory leak. This rarely
occurred with UDP clients, but could be a significant problem
for a server handling a steady rate of TCP queries.

A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process.

For more information:
Tue, 24 Jul 2012
[ 19:23 dougb ] Original commit 
301487 dns/bind96/Makefile
301487 dns/bind96/distinfo
301487 dns/bind97/Makefile
301487 dns/bind97/distinfo
301487 dns/bind98/Makefile
301487 dns/bind98/distinfo
301487 dns/bind99/Makefile
301487 dns/bind99/distinfo
301487 security/vuxml/vuln.xml
Heavy DNSSEC Validation Load Can Cause a "Bad Cache" Assertion Failure
in BIND9

High numbers of queries with DNSSEC validation enabled can cause an
assertion failure in named, caused by using a "bad cache" data structure
before it has been initialized.

CVE: CVE-2012-3817
Posting date: 24 July, 2012
Mon, 4 Jun 2012
[ 21:51 dougb ] Original commit 
1.122 dns/bind96/Makefile
1.73 dns/bind96/distinfo
1.25 dns/bind97/Makefile
1.19 dns/bind97/distinfo
1.15 dns/bind98/Makefile
1.13 dns/bind98/distinfo
1.9 dns/bind99/Makefile
1.7 dns/bind99/distinfo
1.2724 security/vuxml/vuln.xml
Upgrade to 9.6-ESV-R7-P1, 9.7.6-P1, 9.8.3-P1, and 9.9.1-P1, the latest
from ISC. These patched versions contain a critical bugfix:

  Processing of DNS resource records where the rdata field is zero length
  may cause various issues for the servers handling them.

  Processing of these records may lead to unexpected outcomes. Recursive
  servers may crash or disclose some portion of memory to the client.
  Secondary servers may crash on restart after transferring a zone
  containing these records. Master servers may corrupt zone data if the
  zone option "auto-dnssec" is set to "maintain". Other unexpected
  problems that are not listed here may also be encountered.

All BIND users are strongly encouraged to upgrade.
Wed, 23 May 2012
[ 04:41 dougb ] Original commit 
1.121 dns/bind96/Makefile
1.72 dns/bind96/distinfo
1.24 dns/bind97/Makefile
1.18 dns/bind97/distinfo
1.14 dns/bind98/Makefile
1.12 dns/bind98/distinfo
Upgrade to BIND versions 9.9.1, 9.8.3, 9.7.6, and 9.6-ESV-R7,
the latest from ISC. These versions all contain the following:

Feature Change

*  BIND now recognizes the TLSA resource record type, created to
   support IETF DANE (DNS-based Authentication of Named Entities)
   [RT #28989]

Bug Fix

*  The locking strategy around the handling of iterative queries
   has been tuned to reduce unnecessary contention in a multi-
   threaded environment.

Each version also contains other critical bug fixes.

All BIND users are encouraged to upgrade to these latest versions.
Wed, 4 Apr 2012
[ 21:49 dougb ] Original commit 
1.23 dns/bind97/Makefile
1.17 dns/bind97/distinfo
1.5 dns/bind97/pkg-plist
Update to version 9.7.5, the latest from ISC, which contains numerous bug fixes.

For the port, switch to using the PORTDOCS macro.

Feature safe:   yes
Wed, 16 Nov 2011
[ 23:41 dougb ] Original commit 
1.119 dns/bind96/Makefile
1.70 dns/bind96/distinfo
1.22 dns/bind97/Makefile
1.16 dns/bind97/distinfo
1.12 dns/bind98/Makefile
1.9 dns/bind98/distinfo
Upgrade to the latest security patch releases to address the
following DDOS bug:

Recursive name servers are failing with an assertion:
INSIST(! dns_rdataset_isassociated(sigrdataset))

At this time it is not thought that authoritative-only servers
are affected, but information about this bug is evolving rapidly.

Because it may be possible to trigger this bug even on networks
that do not allow untrusted users to access the recursive name
servers (perhaps via specially crafted e-mail messages, and/or
malicious web sites) it is recommended that ALL operators of
recursive name servers upgrade immediately.

For more information see:
which will be updated as more information becomes available.

Feature safe:   yes
Tue, 2 Aug 2011
[ 07:03 dougb ] Original commit 
1.20 dns/bind97/Makefile
1.15 dns/bind97/distinfo
1.4 dns/bind97/pkg-plist
Update to version 9.7.4 which contains various bug fixes and improvements:
Tue, 5 Jul 2011
[ 21:18 dougb ] Original commit 
1.116 dns/bind96/Makefile
1.68 dns/bind96/distinfo
1.18 dns/bind97/Makefile
1.14 dns/bind97/distinfo
Update to versions 9.7.3-P3, and 9.6-ESV-R4-P3.


This update addresses the following vulnerability:

Severity:       High
Exploitable:    Remotely


A defect in the affected BIND 9 versions allows an attacker to remotely
cause the "named" process to exit using a specially crafted packet. This
defect affects both recursive and authoritative servers. The code location
of the defect makes it impossible to protect BIND using ACLs configured
within named.conf or by disabling any features at compile-time or run-time.
Fri, 27 May 2011
[ 23:47 dougb ] Original commit 
1.115 dns/bind96/Makefile
1.67 dns/bind96/distinfo
1.1 dns/bind96/files/patch-bin__nsupdate__nsupdate.c
1.16 dns/bind97/Makefile
1.13 dns/bind97/distinfo
1.1 dns/bind97/files/patch-bin__nsupdate__nsupdate.c
Upgrade to 9.6-ESV-R4-P1 and 9.7.3-P1, which address the following issues:

1. Very large RRSIG RRsets included in a negative cache can trigger
an assertion failure that will crash named (BIND 9 DNS) due to an
off-by-one error in a buffer size check.

This bug affects all resolving name servers, whether DNSSEC validation
is enabled or not, on all BIND versions prior to today. There is a
possibility of malicious exploitation of this bug by remote users.

2. Named could fail to validate zones listed in a DLV that validated
insecure without using DLV and had DS records in the parent zone.

Add a patch provided by ru@ and confirmed by ISC to fix a crash at
shutdown time when a SIG(0) key is being used.
Tue, 15 Feb 2011
[ 01:47 dougb ] Original commit 
1.15 dns/bind97/Makefile
1.12 dns/bind97/distinfo
Update to 9.7.3, the latest from ISC:

 * Zones may be dynamically added and removed with the "rndc addzone"
   and "rndc delzone" commands. These dynamically added zones are
   written to a per-view configuration file. Do not rely on the
   configuration file name nor contents as this will change in a
   future release. This is an experimental feature at this time.
 * A new command "rndc secroots" was added to dump a combined summary
   of the currently managed keys combined with statically configured
   trust anchors.
 * Added support to load new keys into managed zones without signing
   immediately with "rndc loadkeys". Added support to link keys with
   "dnssec-keygen -S" and "dnssec-settime -S".
Fri, 3 Dec 2010
[ 22:39 dougb ] Original commit 
1.13 dns/bind97/Makefile
1.11 dns/bind97/distinfo
1.1 dns/bind97/pkg-install
Update to version 9.7.2-P3, the latest from ISC, which addresses
the following security vulnerabilities.

For more information regarding these issues please see:

1. Cache incorrectly allows ncache and rrsig for the same type

   Affects resolver operators whose servers are open to potential
   attackers. Triggering the bug will cause the server to crash.

   This bug applies even if you do not have DNSSEC enabled.
(Only the first 15 lines of the commit message are shown above View all of this commit message)
[ 19:39 dougb ] Original commit 
1.12 dns/bind97/Makefile
1.10 dns/bind97/distinfo
Convert this to a master port for ../bind-tools

Remove CONFLICTS for the now-removed BIND 9.3

Remove OPTION for threads on < RELENG_7

Remove MD5 from distinfo
Mon, 18 Oct 2010
[ 21:06 dougb ] Original commit 
1.11 dns/bind97/Makefile
1.9 dns/bind97/distinfo
Update to 9.7.2-P2, the latest version from ISC
Sat, 17 Jul 2010
[ 07:54 dougb ] Original commit 
1.10 dns/bind97/Makefile
1.8 dns/bind97/distinfo
Updgrade to version 9.7.1-P2 which addresses a DNSSEC-related bug.

If a query is made explicitly for a record of type 'RRSIG' to a validating
recursive server running BIND 9.7.1 or 9.7.1-P1, and the server has one or
more trust anchors configured statically and/or via DLV, then if the answer
is not already in cache, the server enters a loop which repeatedly generates
queries for RRSIGs to the authoritative servers for the zone containing the
queried name.


Versions affected:      9.7.1, 9.7.1-P1
Severity:               High
Exploitable:            remotely
Sat, 10 Jul 2010
[ 21:36 dougb ] Original commit 
1.9 dns/bind97/Makefile
1.7 dns/bind97/distinfo
Upgrade to version 9.7.1-P1. The patch addresses 2 areas in the resolver
code where the 9.7.x series tightened its adherence to the DNS protocol
as written, vs. the 9.6.x series which was more liberal in what it accepted.

1. Restore processing of certain forms of negative responses that do
   not contain all of the required elements to avoid aggressive
   re-querying of authority servers.
2. Accept answers from authority servers without the AA bit set
   if they meet the other requirements of an answer packet.

More detail can be found here:
Thu, 17 Jun 2010
[ 22:35 dougb ] Original commit 
1.7 dns/bind97/Makefile
1.6 dns/bind97/distinfo
Update to version 9.7.1, the latest from ISC.

This version has numerous minor bug fixes, please refer to the
CHANGES file for details. Many (but not all) of the fixes are
DNSSEC-related, and all users who are doing DNSSEC validation
are encouraged to upgrade to this version.
Thu, 20 May 2010
[ 06:34 dougb ] Original commit 
1.2 dns/bind-tools/Makefile
1.2 dns/bind-tools/distinfo
1.106 dns/bind94/Makefile
1.62 dns/bind94/distinfo
1.109 dns/bind95/Makefile
1.61 dns/bind95/distinfo
1.110 dns/bind96/Makefile
1.63 dns/bind96/distinfo
1.6 dns/bind97/Makefile
1.5 dns/bind97/distinfo
Update to the latest patch set from ISC, which addresses the following:

   Named could return SERVFAIL for negative responses
   from unsigned zones.
Wed, 17 Mar 2010
[ 05:35 dougb ] Original commit 
1.105 dns/bind94/Makefile
1.61 dns/bind94/distinfo
1.108 dns/bind95/Makefile
1.60 dns/bind95/distinfo
1.109 dns/bind96/Makefile
1.62 dns/bind96/distinfo
1.5 dns/bind97/Makefile
1.4 dns/bind97/distinfo
Update to the latest patchfix releases to deal with the problems
related to the handling of broken DNSSEC trust chains.

This fix is only necessary for those who have DNSSEC validation
enabled and configure trust anchors from third parties, either
manually, or through a system like DLV.
Wed, 17 Feb 2010
[ 06:13 dougb ] Original commit 
1.4 dns/bind97/Makefile
1.3 dns/bind97/distinfo
1.2 dns/bind97/pkg-descr
1.3 dns/bind97/pkg-plist
Update to the release version of BIND 9.7.0, and remove the -devel
suffix as a result.

Feature safe:   yes
Mon, 1 Feb 2010
[ 20:57 dougb ] Original commit 
1.3 dns/bind97/Makefile
1.2 dns/bind97/distinfo
1.2 dns/bind97/pkg-plist
Update to 9.7.0rc2 which has numerous bug fixes, especially
Mon, 14 Dec 2009
[ 06:25 dougb ] Original commit 
1.110 dns/Makefile
1.1 dns/bind97/Makefile
1.1 dns/bind97/distinfo
1.1 dns/bind97/pkg-descr
1.1 dns/bind97/pkg-message
1.1 dns/bind97/pkg-plist
Add BIND 9.7.0rc1 with a -devel suffix for now so that people can
start testing it sooner rather than later. When the final version
is released the -devel will be removed.

Some of the new features of BIND 9.7.x are:

        - Fully automatic signing of zones by "named"
        - Simplified configuration of DNSSEC Lookaside Validation (DLV)
        - Simplified configuration of Dynamic DNS, using the "ddns-confgen"
          command line tool or the "local" update-policy option
        - New named option "attach-cache" that allows multiple views to
          share a single cache
        - DNS rebinding attack prevention
        - New default values for dnssec-keygen parameters
        - Support for RFC 5011 automated trust anchor maintenance
          (see README.rfc5011 for additional details)
        - Smart signing: simplified tools for zone signing and key
        - Improved PKCS#11 support

Number of commits found XX: 23

User Login
Create account

Servers and bandwidth provided by
New York Internet, iXsystems, and RootBSD

This site
What is FreshPorts?
About the authors
How big is it?
The latest upgrade!

Enter Keywords:

Latest Vulnerabilities
puppetdb5Aug 11
bftpdAug 10
apache24*Aug 08
gitlab-ceAug 06
goAug 06
sqlite3*Aug 06
typo3-10Aug 04
typo3-9Aug 04
libX11Aug 01
xephyrAug 01
xorg-dmxAug 01
xorg-nestserverAug 01
xorg-serverAug 01
xorg-vfbserverAug 01
xwaylandAug 01

15 vulnerabilities affecting 88 ports have been reported in the past 14 days

* - modified, not new

All vulnerabilities

Last updated:
2020-08-11 04:16:47

Deleted ports
Sanity Test Failures

NEW Graphs (Javascript)

Calculated hourly:
Port count 40291
Broken 88
Deprecated 602
Ignore 323
Forbidden 5
Restricted 147
Vulnerable 20
Expired 3
Set to expire 572
Interactive 0
new 24 hours 7
new 48 hours10
new 7 days21
new fortnight66
new month143

Servers and bandwidth provided by
New York Internet, iXsystems, and RootBSD
Valid HTML, CSS, and RSS.
Copyright © 2000-2020 Dan Langille. All rights reserved.