DNS critical recursion ISSUE* FIX IT NOW!

[joseph]

If you are running DNS with recursion, it's highly recommended to upgrade to 9.5.0-P1, 9.4.2-P1 or 9.3.5-P1 as soon as possible:

It's needed to be fixed TODAY:

after updating BIND to the right version, your configuration file also needs to be adjusted.

If recursion supported by older files, please add a new ACL in named.conf like this:
allow-recursion {
aclname;
};
The other solution is that only local recursive should be allowed.

Joseph - 2008-07-23 10:46 CST

[joseph]

If you are going to compile bind from source, here is the config parameters listed in bind.spec from bind-9.2.4-28.0.1.el4.src.rpm:

cp -f /usr/share/libtool/config.{guess,sub} .
export CFLAGS="$RPM_OPT_FLAGS"
if pkg-config openssl ; then
        export CFLAGS="$CFLAGS `pkg-config --cflags openssl`"
        export CPPFLAGS="$CPPFLAGS `pkg-config --cflags-only-I openssl`"
        export LDFLAGS="$LDFLAGS `pkg-config --libs-only-L openssl`"
fi
export CFLAGS="$CFLAGS -g"
%configure --with-libtool --localstatedir=/var \
        --enable-threads \
        --enable-ipv6 \
        --with-openssl=/usr

make