Bug 8966

Summary: bind: CVE-2015-8704, CVE-2015-8705
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: connectivityAssignee: Sona Sarmadi <sona.sarmadi>
Status: VERIFIED FIXED QA Contact: Alexandru Roman <alexandru.costinx.roman>
Severity: normal    
Priority: High CC: akuster, bogdanx.a.voiculescu, derek, meta.mr.watcher, meta.watcher
Version: unspecified   
Target Milestone: 2.1 M2   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Sona Sarmadi 2016-01-21 07:04:11 UTC 
The following flaw in BIND was reported by ISC:

CVE: CVE-2015-8704 bind: specific APL data could trigger an INSIST in apl_42.c

Versions affected: 
9.3.0->9.8.8, 9.9.0->9.9.8-P2, 9.9.3-S1->9.9.8-S3, 9.10.0->9.10.3-P2
Severity: High
Exploitable:  Remotely

9.9.8 patch:
https://bugzilla.redhat.com/attachment.cgi?id=1115781
================================================================
CVE: CVE-2015-8705 
bind: crash when converting OPT resource records and ECS options to text format

Versions affected: 
9.10.0->9.10.3-P2
Severity:
Medium
Exploitable: Remotely

9.10.3-rt41396-and-rt41397-CVE-2015-8704-and-CVE-2015-8705.diff: https://bugzilla.redhat.com/attachment.cgi?id=1115783

==================================================================
References:
https://kb.isc.org/article/AA-01335/74/CVE-2015-8704%3A-Specific-APL-data-could-trigger-an-INSIST-in-apl_42.c.html
https://kb.isc.org/article/AA-01336/74/CVE-2015-8705%3A-Problems-converting-OPT-resource-records-and-ECS-options-to-text-format-can-cause-BIND-to-terminate.html

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8704
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8705
Comment 1 Armin Kuster 2016-01-24 23:03:31 UTC 
master package update submitted

http://patches.openembedded.org/patch/113511/
Comment 2 Sona Sarmadi 2016-01-26 07:49:34 UTC 
patch sent for jethro:
Patchwork [jethro] bind: CVE-2015-8704 and CVE-2015-8705
http://patchwork.openembedded.org/patch/113677/

fido & dizzy:
Patchwork [fido,dizzy] bind: CVE-2015-8704
http://patchwork.openembedded.org/patch/113675/
Comment 3 Derek Straka 2016-01-26 16:59:50 UTC 
dizzy and fido use bind 9.9.5 so they are not affected by CVE-2015-8705
Comment 5 Alexandru Roman 2016-02-08 09:52:36 UTC 
Verified.