Versions affected: 9.10.0 -> 9.10.3-P3 Severity: High Exploitable: Remotely Description: BIND 9.10 has preliminary support for DNS cookies (or source identity tokens), a proposed mechanism designed to allow lightweight transaction security between a querying party and a nameserver. An error in the BIND code implementing support for this optional feature permits a deliberately misconstructed packet containing multiple cookie options to cause named to terminate with an INSIST assertion failure in resolver.c if DNS cookie support is enabled in the server. Only servers with DNS cookie support enabled at build time can be affected by this defect; in servers which do not have DNS cookie support selected any cookies encountered will be ignored as unknown option types. Impact: Servers which are built with DNS cookie support enabled are vulnerable to denial of service if an attacker can cause them to receive and process a response that contains multiple cookie options. References: https://kb.isc.org/article/AA-01351
Affected branches: ================== Master: affetced: fixed in the following patch: http://patchwork.openembedded.org/patch/120095/ Jethro: affected Fido: Not affected
Sent a patch for master.
commit 74ab080d3475cfbf4ad0f6e747601c71709f2e44 Author: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Fri Apr 15 15:03:17 2016 +0300 bind: CVE-2016-2088 Duplicate EDNS COOKIE options in a response could trigger an assertion failure: Fix with a backport. bind as built with the oe-core recipe is not at risk: Only servers which are built with DNS cookie support (--enable-sit) are vulnerable to denial of service. Fixes [YOCTO #9438] (From OE-Core rev: da38a9840b32e80464e2938395db5c9167729f7e) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Verified on master f7b520878babbaa7527151f22c031ae160512753 It will be ported on Jethro? Jethro is affected