Bug 9400

Summary: bind: CVE-2016-1285, CVE-2016-1286 multiple CVEs
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: connectivityAssignee: Sona Sarmadi <sona.sarmadi>
Status: VERIFIED FIXED QA Contact: Alexandru Roman <alexandru.costinx.roman>
Severity: major    
Priority: High CC: alexandru.costinx.roman, meta.mr.watcher, meta.watcher, randy.macleod, ross.burton
Version: 2.1   
Target Milestone: 2.1 M4   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Sona Sarmadi 2016-04-06 08:21:46 UTC 
The following flaw found in BIND was reported by ISC:

An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c.

An attacker able to cause a server to make a query deliberately chosen to generate a response containing a signature record which would exercise this vulnerability can cause named to stop execution with an assertion failure, resulting in denial of service to clients. Recursive resolvers are at the highest risk of vulnerability to this attack but authoritative-only servers may be also be vulnerable if the attacker can control the answers for records requested when the authoritative server is performing service on zones (e.g. a slave server doing SOA queries.) Servers may be affected even if they are not performing validation or have DNSSEC disabled entirely as long as they receive a response containing offending signature records. Disabling DNSSEC does not provide protection against this vulnerability.

External References:
https://kb.isc.org/article/AA-01353
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286

Upstream commits:

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=a3d327bf1ceaaeabb20223d8de85166e940b9f12
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=7602be276a73a6eb5431c5acd9718e68a55e8b61

Versions affected: 
9.0.0 -> 9.8.8, 9.9.0 -> 9.9.8-P3, 9.9.3-S1 -> 9.9.8-S5,  9.10.0 -> 9.10.3-P3
Severity: High
Exploitable: Remotely 

Affected Yocto branches:
Master: bind_9.10.3-P3.bb -> affetced
Jethro: bind_9.10.2-P4 -> affected
Fido & dizzy:  bind_9.9.5.bb -> affetced
Comment 1 Sona Sarmadi 2016-04-08 05:31:44 UTC 
Patch sent for fido:
http://patchwork.openembedded.org/patch/119859/
Comment 2 Sona Sarmadi 2016-04-08 06:30:31 UTC 
Patch sent for dizzy:
http://patchwork.openembedded.org/patch/119865/
Comment 3 Sona Sarmadi 2016-04-08 06:33:40 UTC 
How the patches have been tested:

Verify that the patches have been applied:

poky/build-dizzy-bind$ ls tmp/work/i586-poky-linux/bind/9.9.5-r0/
CVE-2015-1349.patch    CVE-2015-5722.patch    CVE-2016-1285.patch    CVE-2016-1286_2.patch
CVE-2015-4620.patch    CVE-2015-8000.patch    CVE-2016-1286_1.patch
fix-typo-in-CVE-2016-1285.patch

built & boot qemu image on fido & dizzy branches:
...

Poky (Yocto Project Reference Distro) 1.7.3 qemux86 /dev/ttyS0

qemux86 login: root
root@qemux86:~# uname -a
Linux qemux86 3.14.29ltsi-yocto-standard #1 SMP PREEMPT Fri Apr 8 07:52:20 CEST 2016 i686 GNU/Linux
root@qemux86:~#
Comment 4 Sona Sarmadi 2016-04-12 08:02:46 UTC 
Patch sent for jethro:
http://patchwork.openembedded.org/patch/120089/

Test: build bind, core-image and booted qemu image:
Poky (Yocto Project Reference Distro) 2.0.1 qemux86 /dev/ttyS0

qemux86 login: root
root@qemux86:~# uname -a
Linux qemux86 4.1.17-yocto-standard #1 SMP PREEMPT Tue Apr 12 09:02:15 CEST 2016 i686 GNU/Linux
root@qemux86:~#
Comment 5 Sona Sarmadi 2016-04-12 10:16:05 UTC 
Patch sent for master:
http://patchwork.openembedded.org/patch/120095/
Comment 6 Sona Sarmadi 2016-04-13 11:09:51 UTC 
[Ross]: Far too late for upgrades in master, can you fix the CVEs as patches please?

[Sona]: New patch sent to the existing version in master.
Comment 7 Ross Burton 2016-04-14 16:52:26 UTC 
Fixed in oe-core 080d1a313e4982dd05846b375ebf936c46934d80.
Comment 8 Alexandru Roman 2016-04-18 10:01:42 UTC 
Verified on master.
For the other branches I can't see the patch files.