9438 2016-04-12 08:19:06 +0000 bind: CVE-2016-2088 2016-05-05 11:48:42 +0000 1 1 7 Build System, Metadata & Runtime OE-Core connectivity 2.0 All Multiple VERIFIED FIXED High major 2.1 M4 9473 1 sona.sarmadi jku bogdanx.a.voiculescu meta.mr.watcher meta.watcher randy.macleod bogdanx.a.voiculescu --- --- No (bug/feature does not impact docs) oldest_to_newest 61067 0 sona.sarmadi 2016-04-12 08:19:06 +0000 Versions affected: 9.10.0 -> 9.10.3-P3 Severity: High Exploitable: Remotely Description: BIND 9.10 has preliminary support for DNS cookies (or source identity tokens), a proposed mechanism designed to allow lightweight transaction security between a querying party and a nameserver. An error in the BIND code implementing support for this optional feature permits a deliberately misconstructed packet containing multiple cookie options to cause named to terminate with an INSIST assertion failure in resolver.c if DNS cookie support is enabled in the server. Only servers with DNS cookie support enabled at build time can be affected by this defect; in servers which do not have DNS cookie support selected any cookies encountered will be ignored as unknown option types. Impact: Servers which are built with DNS cookie support enabled are vulnerable to denial of service if an attacker can cause them to receive and process a response that contains multiple cookie options. References: https://kb.isc.org/article/AA-01351 61075 1 sona.sarmadi 2016-04-12 10:19:42 +0000 Affected branches: ================== Master: affetced: fixed in the following patch: http://patchwork.openembedded.org/patch/120095/ Jethro: affected Fido: Not affected 61281 2 jku 2016-04-15 12:20:23 +0000 Sent a patch for master. 61385 3 jku 2016-04-19 10:45:46 +0000 commit 74ab080d3475cfbf4ad0f6e747601c71709f2e44 Author: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Fri Apr 15 15:03:17 2016 +0300 bind: CVE-2016-2088 Duplicate EDNS COOKIE options in a response could trigger an assertion failure: Fix with a backport. bind as built with the oe-core recipe is not at risk: Only servers which are built with DNS cookie support (--enable-sit) are vulnerable to denial of service. Fixes [YOCTO #9438] (From OE-Core rev: da38a9840b32e80464e2938395db5c9167729f7e) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 61978 4 bogdanx.a.voiculescu 2016-05-05 11:48:42 +0000 Verified on master f7b520878babbaa7527151f22c031ae160512753 It will be ported on Jethro? Jethro is affected