+++ This bug was initially created as a clone of Bug #224443 +++ Description of problem: fetchctx structures, not keeping count of its uses, might be read even after beind deallocated resulting in name server denial of service under certain circumstances. Version-Release number of selected component (if applicable): Unclear whether this issue also affects 3.2 BIND, besides 3.3. For sure affects FC-5, FC-6 and RHEL-5 How reproducible: Hardly ever. Steps to Reproduce: No known way to reproduce. The advisory notes, that the issue can be partly mitigated by disabling recursion, so probably some deep recursive queries might trigger the bug? Actual results: Server DoS? Expected results: What would you expect from read of deallocated memory? :) Additional info: ISC is not particularly good at providing either patches or information about the flaws. The attached patch incorporates another fix which changes roughly the same code. -- Additional comment from lkundrak on 2007-01-25 14:04 EST -- Created an attachment (id=146596) Fix for BIND out-of bound read DoS sucked from upstream BIND release
Created attachment 147023 [details] proposed fix
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2007-0057.html
*** Bug 238117 has been marked as a duplicate of this bug. ***