diff options
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch')
-rw-r--r-- | meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch | 154 |
1 files changed, 0 insertions, 154 deletions
diff --git a/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch b/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch deleted file mode 100644 index 2149bd180d..0000000000 --- a/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch +++ /dev/null | |||
@@ -1,154 +0,0 @@ | |||
1 | From 70037e040e587329cec82123e12b9f4f7c945f67 Mon Sep 17 00:00:00 2001 | ||
2 | From: Mark Andrews <marka@isc.org> | ||
3 | Date: Thu, 18 Feb 2016 12:11:27 +1100 | ||
4 | Subject: [PATCH] 4318. [security] Malformed control messages can | ||
5 | trigger assertions in named and rndc. (CVE-2016-1285) | ||
6 | [RT #41666] | ||
7 | |||
8 | (cherry picked from commit a2b15b3305acd52179e6f3dc7d073b07fbc40b8e) | ||
9 | |||
10 | CVE: CVE-2016-1285 | ||
11 | Upstream-Status: Backport | ||
12 | [Removed doc/arm/notes.xml changes from upstream patch] | ||
13 | |||
14 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
15 | --- | ||
16 | CHANGES | 3 +++ | ||
17 | bin/named/control.c | 2 +- | ||
18 | bin/named/controlconf.c | 2 +- | ||
19 | bin/rndc/rndc.c | 8 ++++---- | ||
20 | doc/arm/notes.xml | 11 +++++++++++ | ||
21 | lib/isccc/cc.c | 14 +++++++------- | ||
22 | 6 files changed, 27 insertions(+), 13 deletions(-) | ||
23 | |||
24 | diff --git a/CHANGES b/CHANGES | ||
25 | index b9bd9ef..2c727d5 100644 | ||
26 | --- a/CHANGES | ||
27 | +++ b/CHANGES | ||
28 | @@ -1,3 +1,6 @@ | ||
29 | +4318. [security] Malformed control messages can trigger assertions | ||
30 | + in named and rndc. (CVE-2016-1285) [RT #41666] | ||
31 | + | ||
32 | --- 9.10.3-P3 released --- | ||
33 | |||
34 | 4288. [bug] Fixed a regression in resolver.c:possibly_mark() | ||
35 | diff --git a/bin/named/control.c b/bin/named/control.c | ||
36 | index 8554335..81340ca 100644 | ||
37 | --- a/bin/named/control.c | ||
38 | +++ b/bin/named/control.c | ||
39 | @@ -69,7 +69,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { | ||
40 | #endif | ||
41 | |||
42 | data = isccc_alist_lookup(message, "_data"); | ||
43 | - if (data == NULL) { | ||
44 | + if (!isccc_alist_alistp(data)) { | ||
45 | /* | ||
46 | * No data section. | ||
47 | */ | ||
48 | diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c | ||
49 | index 765afdd..a39ab8b 100644 | ||
50 | --- a/bin/named/controlconf.c | ||
51 | +++ b/bin/named/controlconf.c | ||
52 | @@ -402,7 +402,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) { | ||
53 | * Limit exposure to replay attacks. | ||
54 | */ | ||
55 | _ctrl = isccc_alist_lookup(request, "_ctrl"); | ||
56 | - if (_ctrl == NULL) { | ||
57 | + if (!isccc_alist_alistp(_ctrl)) { | ||
58 | log_invalid(&conn->ccmsg, ISC_R_FAILURE); | ||
59 | goto cleanup_request; | ||
60 | } | ||
61 | diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c | ||
62 | index cb17050..b6e05c8 100644 | ||
63 | --- a/bin/rndc/rndc.c | ||
64 | +++ b/bin/rndc/rndc.c | ||
65 | @@ -255,8 +255,8 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) { | ||
66 | isccc_cc_fromwire(&source, &response, algorithm, &secret)); | ||
67 | |||
68 | data = isccc_alist_lookup(response, "_data"); | ||
69 | - if (data == NULL) | ||
70 | - fatal("no data section in response"); | ||
71 | + if (!isccc_alist_alistp(data)) | ||
72 | + fatal("bad or missing data section in response"); | ||
73 | result = isccc_cc_lookupstring(data, "err", &errormsg); | ||
74 | if (result == ISC_R_SUCCESS) { | ||
75 | failed = ISC_TRUE; | ||
76 | @@ -321,8 +321,8 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) { | ||
77 | isccc_cc_fromwire(&source, &response, algorithm, &secret)); | ||
78 | |||
79 | _ctrl = isccc_alist_lookup(response, "_ctrl"); | ||
80 | - if (_ctrl == NULL) | ||
81 | - fatal("_ctrl section missing"); | ||
82 | + if (!isccc_alist_alistp(_ctrl)) | ||
83 | + fatal("bad or missing ctrl section in response"); | ||
84 | nonce = 0; | ||
85 | if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS) | ||
86 | nonce = 0; | ||
87 | diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c | ||
88 | index 47a3b74..2bb961e 100644 | ||
89 | --- a/lib/isccc/cc.c | ||
90 | +++ b/lib/isccc/cc.c | ||
91 | @@ -403,13 +403,13 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length, | ||
92 | * Extract digest. | ||
93 | */ | ||
94 | _auth = isccc_alist_lookup(alist, "_auth"); | ||
95 | - if (_auth == NULL) | ||
96 | + if (!isccc_alist_alistp(_auth)) | ||
97 | return (ISC_R_FAILURE); | ||
98 | if (algorithm == ISCCC_ALG_HMACMD5) | ||
99 | hmac = isccc_alist_lookup(_auth, "hmd5"); | ||
100 | else | ||
101 | hmac = isccc_alist_lookup(_auth, "hsha"); | ||
102 | - if (hmac == NULL) | ||
103 | + if (!isccc_sexpr_binaryp(hmac)) | ||
104 | return (ISC_R_FAILURE); | ||
105 | /* | ||
106 | * Compute digest. | ||
107 | @@ -728,7 +728,7 @@ isccc_cc_createack(isccc_sexpr_t *message, isc_boolean_t ok, | ||
108 | REQUIRE(ackp != NULL && *ackp == NULL); | ||
109 | |||
110 | _ctrl = isccc_alist_lookup(message, "_ctrl"); | ||
111 | - if (_ctrl == NULL || | ||
112 | + if (!isccc_alist_alistp(_ctrl) || | ||
113 | isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS || | ||
114 | isccc_cc_lookupuint32(_ctrl, "_tim", &t) != ISC_R_SUCCESS) | ||
115 | return (ISC_R_FAILURE); | ||
116 | @@ -773,7 +773,7 @@ isccc_cc_isack(isccc_sexpr_t *message) | ||
117 | isccc_sexpr_t *_ctrl; | ||
118 | |||
119 | _ctrl = isccc_alist_lookup(message, "_ctrl"); | ||
120 | - if (_ctrl == NULL) | ||
121 | + if (!isccc_alist_alistp(_ctrl)) | ||
122 | return (ISC_FALSE); | ||
123 | if (isccc_cc_lookupstring(_ctrl, "_ack", NULL) == ISC_R_SUCCESS) | ||
124 | return (ISC_TRUE); | ||
125 | @@ -786,7 +786,7 @@ isccc_cc_isreply(isccc_sexpr_t *message) | ||
126 | isccc_sexpr_t *_ctrl; | ||
127 | |||
128 | _ctrl = isccc_alist_lookup(message, "_ctrl"); | ||
129 | - if (_ctrl == NULL) | ||
130 | + if (!isccc_alist_alistp(_ctrl)) | ||
131 | return (ISC_FALSE); | ||
132 | if (isccc_cc_lookupstring(_ctrl, "_rpl", NULL) == ISC_R_SUCCESS) | ||
133 | return (ISC_TRUE); | ||
134 | @@ -806,7 +806,7 @@ isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now, | ||
135 | |||
136 | _ctrl = isccc_alist_lookup(message, "_ctrl"); | ||
137 | _data = isccc_alist_lookup(message, "_data"); | ||
138 | - if (_ctrl == NULL || _data == NULL || | ||
139 | + if (!isccc_alist_alistp(_ctrl) || !isccc_alist_alistp(_data) || | ||
140 | isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS || | ||
141 | isccc_cc_lookupstring(_data, "type", &type) != ISC_R_SUCCESS) | ||
142 | return (ISC_R_FAILURE); | ||
143 | @@ -995,7 +995,7 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message, | ||
144 | isccc_sexpr_t *_ctrl; | ||
145 | |||
146 | _ctrl = isccc_alist_lookup(message, "_ctrl"); | ||
147 | - if (_ctrl == NULL || | ||
148 | + if (!isccc_alist_alistp(_ctrl) || | ||
149 | isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS || | ||
150 | isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS) | ||
151 | return (ISC_R_FAILURE); | ||
152 | -- | ||
153 | 1.9.1 | ||
154 | |||