Bug 9438

Summary:	bind: CVE-2016-2088
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Sona Sarmadi <sona.sarmadi>
Component:	connectivity	Assignee:	Jussi Kukkonen <jku>
Status:	VERIFIED FIXED	QA Contact:	Bogdan Alexandru Voiculescu <bogdanx.a.voiculescu>
Severity:	major
Priority:	High	CC:	bogdanx.a.voiculescu, meta.mr.watcher, meta.watcher, randy.macleod
Version:	2.0
Target Milestone:	2.1 M4
Hardware:	All
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)
Bug Depends on:
Bug Blocks:	9473

Description Sona Sarmadi 2016-04-12 08:19:06 UTC

Versions affected: 
9.10.0 -> 9.10.3-P3
Severity:  High
Exploitable:  Remotely

Description:

BIND 9.10 has preliminary support for DNS cookies (or source identity tokens), a proposed mechanism designed to allow lightweight transaction security between a querying party and a nameserver. An error in the BIND code implementing support for this optional feature permits a deliberately misconstructed packet containing multiple cookie options to cause named to terminate with an INSIST assertion failure in resolver.c if DNS cookie support is enabled in the server.  Only servers with DNS cookie support enabled at build time can be affected by this defect; in servers which do not have DNS cookie support selected any cookies encountered will be ignored as unknown option types.

Impact:

Servers which are built with DNS cookie support enabled are vulnerable to denial of service if an attacker can cause them to receive and process a response that contains multiple cookie options.

References:
https://kb.isc.org/article/AA-01351

Comment 1 Sona Sarmadi 2016-04-12 10:19:42 UTC

Affected branches:
==================
Master: affetced: fixed in the following patch: http://patchwork.openembedded.org/patch/120095/
Jethro: affected
Fido: Not affected

Comment 2 Jussi Kukkonen 2016-04-15 12:20:23 UTC

Sent a patch for master.

Comment 3 Jussi Kukkonen 2016-04-19 10:45:46 UTC

commit 74ab080d3475cfbf4ad0f6e747601c71709f2e44
Author: Jussi Kukkonen <jussi.kukkonen@intel.com>
Date:   Fri Apr 15 15:03:17 2016 +0300

    bind: CVE-2016-2088
    
    Duplicate EDNS COOKIE options in a response could trigger an
    assertion failure: Fix with a backport.
    
    bind as built with the oe-core recipe is not at risk: Only servers
    which are built with DNS cookie support (--enable-sit) are vulnerable
    to denial of service.
    
    Fixes [YOCTO #9438]
    
    (From OE-Core rev: da38a9840b32e80464e2938395db5c9167729f7e)
    
    Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
    Signed-off-by: Ross Burton <ross.burton@intel.com>
    Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Comment 4 Bogdan Alexandru Voiculescu 2016-05-05 11:48:42 UTC

Verified on master f7b520878babbaa7527151f22c031ae160512753

It will be ported on Jethro? Jethro is affected