diff options
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch')
| -rw-r--r-- | meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch | 79 |
1 files changed, 79 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch b/meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch new file mode 100644 index 0000000000..5002147f1a --- /dev/null +++ b/meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch | |||
| @@ -0,0 +1,79 @@ | |||
| 1 | From 456e1eadd2a3a2fb9617e60d4db90ef4ba7c6ba3 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Mukund Sivaraman <muks@isc.org> | ||
| 3 | Date: Mon, 22 Feb 2016 12:22:43 +0530 | ||
| 4 | Subject: [PATCH] Fix resolver assertion failure due to improper DNAME handling | ||
| 5 | (CVE-2016-1286) (#41753) | ||
| 6 | |||
| 7 | (cherry picked from commit 5995fec51cc8bb7e53804e4936e60aa1537f3673) | ||
| 8 | |||
| 9 | Hand applied Changelog changes. | ||
| 10 | |||
| 11 | CVE: CVE-2016-1286 | ||
| 12 | Upstream-Status: Backport | ||
| 13 | |||
| 14 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
| 15 | --- | ||
| 16 | diff -ruN a/CHANGES b/CHANGES | ||
| 17 | --- a/CHANGES 2016-04-11 09:46:42.075057394 +0200 | ||
| 18 | +++ b/CHANGES 2016-04-11 09:44:21.857148819 +0200 | ||
| 19 | @@ -1,3 +1,7 @@ | ||
| 20 | +4319. [security] Fix resolver assertion failure due to improper | ||
| 21 | + DNAME handling when parsing fetch reply messages. | ||
| 22 | + (CVE-2016-1286) [RT #41753] | ||
| 23 | + | ||
| 24 | 4318. [security] Malformed control messages can trigger assertions | ||
| 25 | in named and rndc. (CVE-2016-1285) [RT #41666] | ||
| 26 | |||
| 27 | diff -ruN a/lib/dns/resolver.c b/lib/dns/resolver.c | ||
| 28 | --- a/lib/dns/resolver.c 2016-04-11 09:36:08.550578585 +0200 | ||
| 29 | +++ b/lib/dns/resolver.c 2016-04-11 09:43:23.091701714 +0200 | ||
| 30 | @@ -6634,21 +6634,26 @@ | ||
| 31 | isc_boolean_t found_dname = ISC_FALSE; | ||
| 32 | dns_name_t *dname_name; | ||
| 33 | |||
| 34 | + /* | ||
| 35 | + * Only pass DNAME or RRSIG(DNAME). | ||
| 36 | + */ | ||
| 37 | + if (rdataset->type != dns_rdatatype_dname && | ||
| 38 | + (rdataset->type != dns_rdatatype_rrsig || | ||
| 39 | + rdataset->covers != dns_rdatatype_dname)) | ||
| 40 | + continue; | ||
| 41 | + | ||
| 42 | + /* | ||
| 43 | + * If we're not chaining, then the DNAME and | ||
| 44 | + * its signature should not be external. | ||
| 45 | + */ | ||
| 46 | + if (!chaining && external) { | ||
| 47 | + log_formerr(fctx, "external DNAME"); | ||
| 48 | + return (DNS_R_FORMERR); | ||
| 49 | + } | ||
| 50 | + | ||
| 51 | found = ISC_FALSE; | ||
| 52 | aflag = 0; | ||
| 53 | if (rdataset->type == dns_rdatatype_dname) { | ||
| 54 | - /* | ||
| 55 | - * We're looking for something else, | ||
| 56 | - * but we found a DNAME. | ||
| 57 | - * | ||
| 58 | - * If we're not chaining, then the | ||
| 59 | - * DNAME should not be external. | ||
| 60 | - */ | ||
| 61 | - if (!chaining && external) { | ||
| 62 | - log_formerr(fctx, | ||
| 63 | - "external DNAME"); | ||
| 64 | - return (DNS_R_FORMERR); | ||
| 65 | - } | ||
| 66 | found = ISC_TRUE; | ||
| 67 | want_chaining = ISC_TRUE; | ||
| 68 | POST(want_chaining); | ||
| 69 | @@ -6677,9 +6682,7 @@ | ||
| 70 | &fctx->domain)) { | ||
| 71 | return (DNS_R_SERVFAIL); | ||
| 72 | } | ||
| 73 | - } else if (rdataset->type == dns_rdatatype_rrsig | ||
| 74 | - && rdataset->covers == | ||
| 75 | - dns_rdatatype_dname) { | ||
| 76 | + } else { | ||
| 77 | /* | ||
| 78 | * We've found a signature that | ||
| 79 | * covers the DNAME. | ||