The following flaw found in BIND was reported by ISC: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. An attacker able to cause a server to make a query deliberately chosen to generate a response containing a signature record which would exercise this vulnerability can cause named to stop execution with an assertion failure, resulting in denial of service to clients. Recursive resolvers are at the highest risk of vulnerability to this attack but authoritative-only servers may be also be vulnerable if the attacker can control the answers for records requested when the authoritative server is performing service on zones (e.g. a slave server doing SOA queries.) Servers may be affected even if they are not performing validation or have DNSSEC disabled entirely as long as they receive a response containing offending signature records. Disabling DNSSEC does not provide protection against this vulnerability. External References: https://kb.isc.org/article/AA-01353 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286 Upstream commits: https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=a3d327bf1ceaaeabb20223d8de85166e940b9f12 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=7602be276a73a6eb5431c5acd9718e68a55e8b61 Versions affected: 9.0.0 -> 9.8.8, 9.9.0 -> 9.9.8-P3, 9.9.3-S1 -> 9.9.8-S5, 9.10.0 -> 9.10.3-P3 Severity: High Exploitable: Remotely Affected Yocto branches: Master: bind_9.10.3-P3.bb -> affetced Jethro: bind_9.10.2-P4 -> affected Fido & dizzy: bind_9.9.5.bb -> affetced
Patch sent for fido: http://patchwork.openembedded.org/patch/119859/
Patch sent for dizzy: http://patchwork.openembedded.org/patch/119865/
How the patches have been tested: Verify that the patches have been applied: poky/build-dizzy-bind$ ls tmp/work/i586-poky-linux/bind/9.9.5-r0/ CVE-2015-1349.patch CVE-2015-5722.patch CVE-2016-1285.patch CVE-2016-1286_2.patch CVE-2015-4620.patch CVE-2015-8000.patch CVE-2016-1286_1.patch fix-typo-in-CVE-2016-1285.patch built & boot qemu image on fido & dizzy branches: ... Poky (Yocto Project Reference Distro) 1.7.3 qemux86 /dev/ttyS0 qemux86 login: root root@qemux86:~# uname -a Linux qemux86 3.14.29ltsi-yocto-standard #1 SMP PREEMPT Fri Apr 8 07:52:20 CEST 2016 i686 GNU/Linux root@qemux86:~#
Patch sent for jethro: http://patchwork.openembedded.org/patch/120089/ Test: build bind, core-image and booted qemu image: Poky (Yocto Project Reference Distro) 2.0.1 qemux86 /dev/ttyS0 qemux86 login: root root@qemux86:~# uname -a Linux qemux86 4.1.17-yocto-standard #1 SMP PREEMPT Tue Apr 12 09:02:15 CEST 2016 i686 GNU/Linux root@qemux86:~#
Patch sent for master: http://patchwork.openembedded.org/patch/120095/
[Ross]: Far too late for upgrades in master, can you fix the CVEs as patches please? [Sona]: New patch sent to the existing version in master.
Fixed in oe-core 080d1a313e4982dd05846b375ebf936c46934d80.
Verified on master. For the other branches I can't see the patch files.