1) CVE-2015-1349: A Problem with Trust Anchor Management Can Cause named to Crash When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors. Versions affected: BIND 9.7.0 -> BIND 9.10.1-P1. Also, b1 and rc1 development versions of the upcoming BIND maintenance releases (9.9.7b1 & rc1, 9.10.2b1 & rc1) are affected. BIND versions 9.9.6, 9.9.6-P1, 9.10.1, and 9.10.1-P1 will terminate consistently with an assertion in zone.c, but previous affected versions may exhibit unpredictable behavior, including server crashes, due to the use of an improperly initialized variable. Severity: High, but requires specific conditions. Exploitable: Remotely, under limited circumstances. Reference: https://kb.isc.org/article/AA-01235/0/CVE-2015-1349%3A-A-Problem-with-Trust-Anchor-Management-Can-Cause-named-to-Crash.html Affected & fixed branches: master| fido (bind_9.9.5)| dizzy(bind_9.9.5) -------------------------------------------------------- Is affected| yes | yes | yes Is fixed | yes | yes | no ========================================================= 2) CVE-2015-4620: Specially Constructed Zone Data Can Cause a Resolver to Crash when Validating An attacker who can cause a validating resolver to query a zone containing specifically constructed contents can cause that resolver to fail an assertion and terminate due to a defect in validation code. Versions affected: BIND 9.7.1 -> 9.7.7, 9.8.0 -> 9.8.8, 9.9.0 -> 9.9.7, 9.10.0 -> 9.10.2-P1. Severity: Critical Exploitable: Remotely Reference: https://kb.isc.org/article/AA-01267/0/CVE-2015-4620%3A-Specially-Constructed-Zone-Data-Can-Cause-a-Resolver-to-Crash-when-Validating.html Affected & fixed branches: master| fido (bind_9.9.5)| dizzy(bind_9.9.5) -------------------------------------------------------- Is affected| yes | yes | yes Is fixed | yes | yes | no ========================================================= 3) CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure Versions affected: 9.1.0 -> 9.8.x, 9.9.0->9.9.7-P1, 9.10.0->9.10.2-P2 Severity: Critical Exploitable: Remotely Reference: https://kb.isc.org/article/AA-01272/0/CVE-2015-5477%3A-An-error-in-handling-TKEY-queries-can-cause-named-to-exit-with-a-REQUIRE-assertion-failure.html Affected & fixed branches: master| fido (bind_9.9.5)| dizzy(bind_9.9.5) -------------------------------------------------------- Is affected| yes | yes | yes Is fixed | yes | yes | yes ========================================================= 4) CVE-2015-5722: Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c Versions affected: BIND 9.0.0 -> 9.8.8, BIND 9.9.0 -> 9.9.7-P2, BIND 9.10.0 -> 9.10.2-P3 Severity: Critical Exploitable: Remotely Reference: https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/ Affected & fixed branches: master| fido (bind_9.9.5)| dizzy(bind_9.9.5) -------------------------------------------------------- Is affected| yes | yes | yes Is fixed | yes | yes | no ========================================================= 5) CVE-2015-5986: An incorrect boundary check can trigger a REQUIRE assertion failure in openpgpkey_61.c Versions affected: 9.9.7 -> 9.9.7-P2 and 9.10.2 -> 9.10.2-P3. Severity: Critical Exploitable: Remotely Reference: https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/ Affected & fixed branches: master| fido (bind_9.9.5)| dizzy(bind_9.9.5) -------------------------------------------------------- Is affected| no | no | no **Note** bind in master is upgraded to bind_9.10.2-P4 which addresses all these CVEs. All these issues affected fido branch are fixed. Remaining issues are to fix the following CVEs in dizzy branch: CVE-2015-5722, CVE-2015-4620 and CVE-2015-1349.
CVE-2015-1349 is fixed in 9.10.2. Other CVEs are fixed in 9.10.3: BIND 9.10.3 BIND 9.10.3 is a maintenance release and addresses bugs found in BIND 9.10.2 and earlier, as well as the security flaws described in CVE-2015-4620, CVE-2015-5477, CVE-2015-5722, and CVE-2015-5986.
Kai submitted a patch to do: bind: 9.10.2-P4 -> 9.10.3 but Ross asked to patch only the specific fixes to address CVEs. This may be a policy error in that bind-9.10.3 is a bug-fix only release and oe-core should accept it for oe-core-2.0.1 at least.
(The tag v9_10_2_P4 on gitweb of https://source.isc.org/git/bind9.git could not open, so list the commits as follow.) Patches to fix CVE-2015-4620, CVE-2015-5477, CVE-2015-5722 and CVE-2015-5986 are all merged in 9.10.2p4. commit dc9507871fd1f4285dfd065c4201feb3876cbbdc Author: Mark Andrews <marka@isc.org> Date: Wed Jun 17 09:13:03 2015 +1000 4138. [bug] A uninitialized value in validator.c could result in a assertion failure. (CVE-2015-4620) [RT #39795] (cherry picked from commit a85c6b35affa7179434c41b277109dca2cbe01ec) commit a5f88548f62ceaec3276fa018996464700070a2e Author: Mark Andrews <marka@isc.org> Date: Tue Jul 14 14:48:42 2015 +1000 4165. [bug] An failure to reset a value to NULL in tkey.c could result in an assertion failure. (CVE-2015-5477) [RT #40046] (cherry picked from commit dbb064aa7972ef918d9a235b713108a4846cbb62) commit 38c9f3da3efbe7e418fa247f273a0dc3ef9aa370 Author: Evan Hunt <each@isc.org> Date: Fri Aug 7 13:30:02 2015 -0700 [v9_10_2_patch] address buffer accounting error 4168. [security] A buffer accounting error could trigger an assertion failure when parsing certain malformed DNSSEC keys. (CVE-2015-5722) [RT #40212] (cherry picked from commit ce9f893e21d2ffc6f6a78bf226c038c396740aeb) * This commit is to fix CVE-2015-5986* commit d79bdae79f17ae34767db9662da7a3e8bce48b3e Author: Evan Hunt <each@isc.org> Date: Tue Aug 11 20:03:16 2015 -0700 [v9_10_2_patch] fix length check in OPENPGPKEY 4170. [security] An incorrect boundary check in the OPENPGPKEY rdatatype could trigger an assertion failure. [RT #40286]
Verified on jethro 2.0.1 : dd0ba9ea4a11ab15348d4fe3574e4b28784db82f
do we have a fido fix for these?
yep.. I am the dork the submitted the fixes. getting old is a blast :) http://cgit.openembedded.org/openembedded-core/commit/meta/recipes-connectivity/bind/bind_9.9.5.bb?h=fido&id=16e80afe187c173e00b734c757a05157855ed504