[rbldnsd] Announce: rbldnsd-0.97a, a bugfix release

[Michael Tokarev]

Rbldnsd version 0.97a released today, a bugfix release.
 From the NEWS file:

0.97a (1 Aug 2003)

  - bugfix: ip4parse_range(): invalid addresses was not marked as such,
    which may result in various crashes when parsing bogus datafiles.
    Note this is remotely exploitable bug: if you grab data from a remote
    system, invalid data may crash you server.  DNS operations (query
    handling etc) aren't affected by this bug, it is in dataset parsing
    code.
    Please note that this fix also restores previously non-working
    detection of non-zero host part in ranges like 1.2.3.4/24 (proper
    form is 1.2.3.0/24).  If you want to process such address ranges,
    specify -e command-line option.

  - feature: recognize and ignore "IN" classname in `generic' dataset,
    so it is now possible to have
      @ IN A 127.0.0.1

The bug in data parsing code has been introduced in version 0.82, when
address ranges in form 127.0.0.1-2 was implemented.  The fix may result
in unexpected behaviour as noted above.  Originally, rbldnsd was made
to reject address ranges with non-zero host part, so the fix restores
this behaviour (controlled by -e option).

It is highly recommended to upgrade, especially if you use data from
other sources: incorrect data may result in crash of your server or
an endless loop.  The bug is very unlikely to be exploitable in a way
that will result in anything more than denial of service, which is
already a severe issue.  Note again that the bug is in dataset parsing
code only, it is not possible to trigger it by sending some specially
crafted DNS request.

/mjt