pkgsrc-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc/trunk]: pkgsrc/net/bind9 Fixes for CVE-2006-4095 and CVE-2006-4096 fr...
details: https://anonhg.NetBSD.org/pkgsrc/rev/8e71197e7c93
branches: trunk
changeset: 518283:8e71197e7c93
user: adrianp <adrianp%pkgsrc.org@localhost>
date: Tue Sep 05 20:45:32 2006 +0000
description:
Fixes for CVE-2006-4095 and CVE-2006-4096 from bind-9.3.2-P1
* Assertion failure in ISC BIND SIG query processing (CVE-2006-4095)
- Recursive servers
Queries for SIG records will trigger an assertion failure if more
than one RRset is returned. However exposure can be minimized by
restricting which sources can ask for recursion.
- Authoritative servers
If a nameserver is serving a RFC 2535 DNSSEC zone and is queried
for the SIG records where there are multiple RRsets, then the
named program will trigger an assertion failure when it tries
to construct the response.
* INSIST failure in ISC BIND recursive query handling code (CVE-2006-4096)
It is possible to trigger an INSIST failure by sending enough
recursive queries such that the response to the query arrives after
all the clients waiting for the response have left the recursion
queue. However exposure can be minimized by restricting which sources
can ask for recursion.
diffstat:
net/bind9/Makefile | 4 +-
net/bind9/distinfo | 4 +-
net/bind9/patches/patch-ap | 22 +++++++
net/bind9/patches/patch-aq | 126 +++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 153 insertions(+), 3 deletions(-)
diffs (184 lines):
diff -r a893090bf9f5 -r 8e71197e7c93 net/bind9/Makefile
--- a/net/bind9/Makefile Tue Sep 05 20:06:42 2006 +0000
+++ b/net/bind9/Makefile Tue Sep 05 20:45:32 2006 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.81 2006/09/03 22:58:26 rillig Exp $
+# $NetBSD: Makefile,v 1.82 2006/09/05 20:45:32 adrianp Exp $
DISTNAME= bind-${BIND_VERSION}
-PKGREVISION= 1
+PKGREVISION= 2
CATEGORIES= net
MASTER_SITES= ftp://ftp.isc.org/isc/bind9/${BIND_VERSION}/
diff -r a893090bf9f5 -r 8e71197e7c93 net/bind9/distinfo
--- a/net/bind9/distinfo Tue Sep 05 20:06:42 2006 +0000
+++ b/net/bind9/distinfo Tue Sep 05 20:45:32 2006 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.28 2006/08/28 16:00:45 seb Exp $
+$NetBSD: distinfo,v 1.29 2006/09/05 20:45:32 adrianp Exp $
SHA1 (bind-9.3.2.tar.gz) = 13efeaf496ed110980088fb5cbe22460f04a0fac
RMD160 (bind-9.3.2.tar.gz) = c825b6308eb374e9bcf9b6ccc48f65d8753c0a6d
@@ -14,3 +14,5 @@
SHA1 (patch-am) = bb267f13dbd30d492f4dfcf9c278b941efa97bed
SHA1 (patch-an) = b3e5cd93890aa9a9cec7c14abf1b62ddbf854b14
SHA1 (patch-ao) = 8a3f8f1b5871af263fc99bc8e552b3ab615bc815
+SHA1 (patch-ap) = 817c39121f1b62f8033822a42d7d9f8a5b5372ea
+SHA1 (patch-aq) = 20cde9869c69dff2aca4784ec9b8b032639776fe
diff -r a893090bf9f5 -r 8e71197e7c93 net/bind9/patches/patch-ap
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/net/bind9/patches/patch-ap Tue Sep 05 20:45:32 2006 +0000
@@ -0,0 +1,22 @@
+$NetBSD: patch-ap,v 1.1 2006/09/05 20:45:32 adrianp Exp $
+
+--- bin/named/query.c.orig 2005-08-11 06:25:20.000000000 +0100
++++ bin/named/query.c
+@@ -2393,7 +2393,7 @@ query_find(ns_client_t *client, dns_fetc
+ is_zone = ISC_FALSE;
+
+ qtype = event->qtype;
+- if (qtype == dns_rdatatype_rrsig)
++ if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
+ type = dns_rdatatype_any;
+ else
+ type = qtype;
+@@ -2434,7 +2434,7 @@ query_find(ns_client_t *client, dns_fetc
+ /*
+ * If it's a SIG query, we'll iterate the node.
+ */
+- if (qtype == dns_rdatatype_rrsig)
++ if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
+ type = dns_rdatatype_any;
+ else
+ type = qtype;
diff -r a893090bf9f5 -r 8e71197e7c93 net/bind9/patches/patch-aq
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/net/bind9/patches/patch-aq Tue Sep 05 20:45:32 2006 +0000
@@ -0,0 +1,126 @@
+$NetBSD: patch-aq,v 1.1 2006/09/05 20:45:32 adrianp Exp $
+
+--- lib/dns/resolver.c.orig 2005-10-14 02:38:48.000000000 +0100
++++ lib/dns/resolver.c
+@@ -762,7 +762,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_re
+ INSIST(result != ISC_R_SUCCESS ||
+ dns_rdataset_isassociated(event->rdataset) ||
+ fctx->type == dns_rdatatype_any ||
+- fctx->type == dns_rdatatype_rrsig);
++ fctx->type == dns_rdatatype_rrsig ||
++ fctx->type == dns_rdatatype_sig);
+
+ isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
+ }
+@@ -3188,7 +3189,8 @@ validated(isc_task_t *task, isc_event_t
+ if (hevent != NULL) {
+ if (!negative && !chaining &&
+ (fctx->type == dns_rdatatype_any ||
+- fctx->type == dns_rdatatype_rrsig)) {
++ fctx->type == dns_rdatatype_rrsig ||
++ fctx->type == dns_rdatatype_sig)) {
+ /*
+ * Don't bind rdatasets; the caller
+ * will iterate the node.
+@@ -3306,7 +3308,8 @@ validated(isc_task_t *task, isc_event_t
+ if (!ISC_LIST_EMPTY(fctx->validators)) {
+ INSIST(!negative);
+ INSIST(fctx->type == dns_rdatatype_any ||
+- fctx->type == dns_rdatatype_rrsig);
++ fctx->type == dns_rdatatype_rrsig ||
++ fctx->type == dns_rdatatype_sig);
+ /*
+ * Don't send a response yet - we have
+ * more rdatasets that still need to
+@@ -3455,14 +3458,15 @@ cache_name(fetchctx_t *fctx, dns_name_t
+ return (result);
+ anodep = &event->node;
+ /*
+- * If this is an ANY or SIG query, we're not going
+- * to return any rdatasets, unless we encountered
++ * If this is an ANY, SIG or RRSIG query, we're not
++ * going to return any rdatasets, unless we encountered
+ * a CNAME or DNAME as "the answer". In this case,
+ * we're going to return DNS_R_CNAME or DNS_R_DNAME
+ * and we must set up the rdatasets.
+ */
+ if ((fctx->type != dns_rdatatype_any &&
+- fctx->type != dns_rdatatype_rrsig) ||
++ fctx->type != dns_rdatatype_rrsig &&
++ fctx->type != dns_rdatatype_sig) ||
+ (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
+ ardataset = event->rdataset;
+ asigrdataset = event->sigrdataset;
+@@ -3521,7 +3525,7 @@ cache_name(fetchctx_t *fctx, dns_name_t
+ */
+ if (secure_domain && rdataset->trust != dns_trust_glue) {
+ /*
+- * SIGs are validated as part of validating the
++ * RRSIGs are validated as part of validating the
+ * type they cover.
+ */
+ if (rdataset->type == dns_rdatatype_rrsig)
+@@ -3591,7 +3595,8 @@ cache_name(fetchctx_t *fctx, dns_name_t
+
+ if (ANSWER(rdataset) && need_validation) {
+ if (fctx->type != dns_rdatatype_any &&
+- fctx->type != dns_rdatatype_rrsig) {
++ fctx->type != dns_rdatatype_rrsig &&
++ fctx->type != dns_rdatatype_sig) {
+ /*
+ * This is The Answer. We will
+ * validate it, but first we cache
+@@ -3763,23 +3768,28 @@ ncache_adderesult(dns_message_t *message
+ isc_result_t *eresultp)
+ {
+ isc_result_t result;
++ dns_rdataset_t rdataset;
++
++ if (ardataset == NULL) {
++ dns_rdataset_init(&rdataset);
++ ardataset = &rdataset;
++ }
+ result = dns_ncache_add(message, cache, node, covers, now,
+ maxttl, ardataset);
+- if (result == DNS_R_UNCHANGED) {
++ if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
+ /*
+- * The data in the cache are better than the negative cache
+- * entry we're trying to add.
++ * If the cache now contains a negative entry and we
++ * care about whether it is DNS_R_NCACHENXDOMAIN or
++ * DNS_R_NCACHENXRRSET then extract it.
+ */
+- if (ardataset != NULL && ardataset->type == 0) {
++ if (ardataset->type == 0) {
+ /*
+- * The cache data is also a negative cache
+- * entry.
++ * The cache data is a negative cache entry.
+ */
+ if (NXDOMAIN(ardataset))
+ *eresultp = DNS_R_NCACHENXDOMAIN;
+ else
+ *eresultp = DNS_R_NCACHENXRRSET;
+- result = ISC_R_SUCCESS;
+ } else {
+ /*
+ * Either we don't care about the nature of the
+@@ -3791,14 +3801,11 @@ ncache_adderesult(dns_message_t *message
+ * XXXRTH There's a CNAME/DNAME problem here.
+ */
+ *eresultp = ISC_R_SUCCESS;
+- result = ISC_R_SUCCESS;
+ }
+- } else if (result == ISC_R_SUCCESS) {
+- if (NXDOMAIN(ardataset))
+- *eresultp = DNS_R_NCACHENXDOMAIN;
+- else
+- *eresultp = DNS_R_NCACHENXRRSET;
++ result = ISC_R_SUCCESS;
+ }
++ if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
++ dns_rdataset_disassociate(ardataset);
+
+ return (result);
+ }
Home |
Main Index |
Thread Index |
Old Index