9400 2016-04-06 08:21:46 +0000 bind: CVE-2016-1285, CVE-2016-1286 multiple CVEs 2016-04-18 10:01:42 +0000 1 1 7 Build System, Metadata & Runtime OE-Core connectivity 2.1 All Multiple VERIFIED FIXED High major 2.1 M4 1 sona.sarmadi sona.sarmadi alexandru.costinx.roman meta.mr.watcher meta.watcher randy.macleod ross.burton alexandru.costinx.roman --- --- No (bug/feature does not impact docs) oldest_to_newest 60836 0 sona.sarmadi 2016-04-06 08:21:46 +0000 The following flaw found in BIND was reported by ISC: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. An attacker able to cause a server to make a query deliberately chosen to generate a response containing a signature record which would exercise this vulnerability can cause named to stop execution with an assertion failure, resulting in denial of service to clients. Recursive resolvers are at the highest risk of vulnerability to this attack but authoritative-only servers may be also be vulnerable if the attacker can control the answers for records requested when the authoritative server is performing service on zones (e.g. a slave server doing SOA queries.) Servers may be affected even if they are not performing validation or have DNSSEC disabled entirely as long as they receive a response containing offending signature records. Disabling DNSSEC does not provide protection against this vulnerability. External References: https://kb.isc.org/article/AA-01353 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286 Upstream commits: https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=a3d327bf1ceaaeabb20223d8de85166e940b9f12 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=7602be276a73a6eb5431c5acd9718e68a55e8b61 Versions affected: 9.0.0 -> 9.8.8, 9.9.0 -> 9.9.8-P3, 9.9.3-S1 -> 9.9.8-S5, 9.10.0 -> 9.10.3-P3 Severity: High Exploitable: Remotely Affected Yocto branches: Master: bind_9.10.3-P3.bb -> affetced Jethro: bind_9.10.2-P4 -> affected Fido & dizzy: bind_9.9.5.bb -> affetced 60958 1 sona.sarmadi 2016-04-08 05:31:44 +0000 Patch sent for fido: http://patchwork.openembedded.org/patch/119859/ 60959 2 sona.sarmadi 2016-04-08 06:30:31 +0000 Patch sent for dizzy: http://patchwork.openembedded.org/patch/119865/ 60960 3 sona.sarmadi 2016-04-08 06:33:40 +0000 How the patches have been tested: Verify that the patches have been applied: poky/build-dizzy-bind$ ls tmp/work/i586-poky-linux/bind/9.9.5-r0/ CVE-2015-1349.patch CVE-2015-5722.patch CVE-2016-1285.patch CVE-2016-1286_2.patch CVE-2015-4620.patch CVE-2015-8000.patch CVE-2016-1286_1.patch fix-typo-in-CVE-2016-1285.patch built & boot qemu image on fido & dizzy branches: ... Poky (Yocto Project Reference Distro) 1.7.3 qemux86 /dev/ttyS0 qemux86 login: root root@qemux86:~# uname -a Linux qemux86 3.14.29ltsi-yocto-standard #1 SMP PREEMPT Fri Apr 8 07:52:20 CEST 2016 i686 GNU/Linux root@qemux86:~# 61065 4 sona.sarmadi 2016-04-12 08:02:46 +0000 Patch sent for jethro: http://patchwork.openembedded.org/patch/120089/ Test: build bind, core-image and booted qemu image: Poky (Yocto Project Reference Distro) 2.0.1 qemux86 /dev/ttyS0 qemux86 login: root root@qemux86:~# uname -a Linux qemux86 4.1.17-yocto-standard #1 SMP PREEMPT Tue Apr 12 09:02:15 CEST 2016 i686 GNU/Linux root@qemux86:~# 61074 5 sona.sarmadi 2016-04-12 10:16:05 +0000 Patch sent for master: http://patchwork.openembedded.org/patch/120095/ 61134 6 sona.sarmadi 2016-04-13 11:09:51 +0000 [Ross]: Far too late for upgrades in master, can you fix the CVEs as patches please? [Sona]: New patch sent to the existing version in master. 61246 7 ross.burton 2016-04-14 16:52:26 +0000 Fixed in oe-core 080d1a313e4982dd05846b375ebf936c46934d80. 61323 8 alexandru.costinx.roman 2016-04-18 10:01:42 +0000 Verified on master. For the other branches I can't see the patch files.