Accepting request 77846 from network

OBS-URL: https://build.opensuse.org/request/show/77846
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/bind?expand=0&rev=66

bind-9.8.0.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:e44183f5a4ab7d3deb3c08171c4821c391d6b10ed8d4bc6485a1fc3ba6490c06
-size 7760161

bind-9.8.0P4.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:abd5761319c54b6bada99830b733067b71ebef7a3203c1af17ab5d28121003ca
+size 7710343

bind.changes

@@ -1,3 +1,35 @@
+-------------------------------------------------------------------
+Tue Jul  5 15:24:10 CEST 2011 - ug@suse.de
+
+* Using Response Policy Zone (RPZ) with DNAME records and querying
+  the subdomain of that label can cause named to crash. Now logs that
+  DNAME is not supported. [RT #24766]
+* If named is configured to be both authoritative and resursive and
+  receives a recursive query for a CNAME in a zone that it is
+  authoritative for, if that CNAME also points to a zone the server
+  is authoritative for, the recursive part of name will not follow
+  the CNAME change and the response will not be a complete CNAME
+  chain. [RT #24455]
+* Using Response Policy Zone (RPZ) to query a wildcard CNAME label
+  with QUERY type SIG/RRSIG, it can cause named to crash. Fix is
+  query type independant. [RT #24715] [CVE-2011-1907]
+* Change #2912 (see CHANGES) exposed a latent bug in the DNS message
+  processing code that could allow certain UPDATE requests to crash
+  named. This was fixed by disambiguating internal database
+  representation vs DNS wire format data. [RT #24777] [CVE-2011-2464]
+* 9.8.0-P4
+
+-------------------------------------------------------------------
+Tue Jun  7 16:37:56 CEST 2011 - ug@suse.de
+
+- A large RRSET from a remote authoritative server that results in
+  the recursive resolver trying to negatively cache the response can
+  hit an off by one code error in named, resulting in named crashing.
+  [RT #24650] [CVE-2011-1910]
+- Zones that have a DS record in the parent zone but are also listed
+  in a DLV and won't validate without DLV could fail to validate. [RT
+  #24631]
+
 -------------------------------------------------------------------
 Mon May 23 19:55:15 UTC 2011 - crrodriguez@opensuse.org
 

bind.spec

@@ -20,13 +20,13 @@
 
 Name:           bind
 %define pkg_name bind
-%define pkg_vers 9.8.0
+%define pkg_vers 9.8.0P4
 BuildRequires:  openldap2-devel
 BuildRequires:  libcap libcap-devel libmysqlclient-devel libxml2-devel openssl openssl-devel
 BuildRequires:  update-desktop-files
 BuildRequires:  krb5-devel
 Summary:        Domain Name System (DNS) Server (named)
-Version:        9.8.0
+Version:        9.8.0P4
 Release:        2
 License:        BSD3c(or similar) ; MIT License (or similar)
 Group:          Productivity/Networking/DNS/Servers
@@ -49,6 +49,7 @@ Patch5:         tmpfs.patch
 Patch51:        pie_compile.diff
 Patch52:        named-bootconf.diff
 Patch54:        named-direct-proc-mount.diff
+patch100:      configure.in.diff2
 Source60:       dlz-schema.txt
 %if %ul_version >= 1
 %define	VENDOR UL
@@ -231,6 +232,9 @@ Authors:
 %patch52
 #%patch53
 %patch54 -p1
+%if 0%{?suse_version} <= 1010
+%patch100 -p1
+%endif
 # modify settings of some files regarding to OS version and vendor
 function replaceStrings()
 {

configure.in.diff2

@@ -0,0 +1,11 @@
+--- a/configure.in
++++ a/configure.in	2011/04/21 13:34:11
+@@ -280,7 +280,7 @@
+ AC_C_INLINE
+ AC_C_VOLATILE
+ AC_CHECK_FUNC(sysctlbyname, AC_DEFINE(HAVE_SYSCTLBYNAME))
+-AC_C_FLEXIBLE_ARRAY_MEMBER
++#AC_C_FLEXIBLE_ARRAY_MEMBER
+ 
+ #
+ # UnixWare 7.1.1 with the feature supplement to the UDK compiler