upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-12 18:40:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[v9_10] remove unnecessary INSIST and prep 9.10.5rc2

Browse source 
4578.	[security]	Some chaining (CNAME or DNAME) responses to upstream
			queries could trigger assertion failures.
			(CVE-2017-3137) [RT #44734]

(cherry picked from commit a1365a0042)
(cherry picked from commit 559cbe04e7)
This commit is contained in:
Evan Hunt 2017-02-23 15:01:30 -08:00
parent 3c14e3c7b5
commit 69fd759b4a
6 changed files with 29 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,4 +1,8 @@
--- 9.10.5 released ---
--- 9.10.5rc2 released ---
4578. [security] Some chaining (CNAME or DNAME) responses to upstream
queries could trigger assertion failures.
(CVE-2017-3137) [RT #44734]
4575. [security] DNS64 with "break-dnssec yes;" can result in an
assertion failure. (CVE-2017-3136) [RT #44653]

2
README
View file

@ -56,7 +56,7 @@ BIND 9.10.5
BIND 9.10.5 is a maintenance release and addresses the security
flaws disclosed in CVE-2016-2775, CVE-2016-2776, CVE-2016-6170,
CVE-2016-8864, CVE-2016-9131, CVE-2016-9147, CVE-2016-9444,
CVE-2017-3135, and CVE-2017-3136,
CVE-2017-3135, CVE-2017-3136, and CVE-2017-3137.
BIND 9.10.4

9
doc/arm/notes.xml
View file

@ -69,11 +69,18 @@
<section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
<itemizedlist>
<listitem>
<para>
Some chaining (i.e., type CNAME or DNAME) responses to upstream
queries could trigger assertion failures. This flaw is disclosed
in CVE-2017-3137. [RT #44734]
</para>
</listitem>
<listitem>
<para>
<command>dns64</command> with <command>break-dnssec yes;</command>
can result in an assertion failure. This flaw is disclosed in
CVE-2017-3136.[RT #44653]
CVE-2017-3136. [RT #44653]
</para>
</listitem>
<listitem>

2
lib/dns/api
View file

@ -7,5 +7,5 @@
# 9.10: 140-149, 170-179
# 9.11: 160-169
LIBINTERFACE = 170
LIBREVISION = 0
LIBREVISION = 1
LIBAGE = 0

38
lib/dns/resolver.c
View file

@ -6946,15 +6946,15 @@ answer_response(fetchctx_t *fctx) {
rdataset->attributes |=
DNS_RDATASETATTR_CACHE;
rdataset->trust = dns_trust_answer;
if (chaining == 0) {
if (external) {
/*
* This data is "the" answer
* to our question only if
* we're not chaining (i.e.
* if we haven't followed
* a CNAME or DNAME).
* This data is outside of
* our query domain, and
* may not be cached.
*/
INSIST(!external);
rdataset->attributes |=
DNS_RDATASETATTR_EXTERNAL;
} else if (chaining == 0) {
/*
* Don't use found_cname here
* as we have just set it
@ -6976,14 +6976,6 @@ answer_response(fetchctx_t *fctx) {
if (aa)
rdataset->trust =
dns_trust_authanswer;
} else if (external) {
/*
* This data is outside of
* our query domain, and
* may not be cached.
*/
rdataset->attributes |=
DNS_RDATASETATTR_EXTERNAL;
}
/*
@ -7158,15 +7150,12 @@ answer_response(fetchctx_t *fctx) {
* If we are not chaining or the first CNAME
* is a synthesised CNAME before the DNAME.
*/
if ((chaining == 0) ||
(chaining == 1U && synthcname))
if (external) {
rdataset->attributes |=
DNS_RDATASETATTR_EXTERNAL;
} else if ((chaining == 0) ||
(chaining == 1U && synthcname))
{
/*
* This data is "the" answer to
* our question only if we're
* not chaining.
*/
INSIST(!external);
if (aflag == DNS_RDATASETATTR_ANSWER) {
have_answer = ISC_TRUE;
found_dname = ISC_TRUE;
@ -7183,9 +7172,6 @@ answer_response(fetchctx_t *fctx) {
if (aa)
rdataset->trust =
dns_trust_authanswer;
} else if (external) {
rdataset->attributes |=
DNS_RDATASETATTR_EXTERNAL;
}
}

4
version
View file

@ -6,6 +6,6 @@ DESCRIPTION=
MAJORVER=9
MINORVER=10
PATCHVER=5
RELEASETYPE=
RELEASEVER=
RELEASETYPE=rc
RELEASEVER=2
EXTENSIONS=