Date: Thu, 17 Nov 2011 22:43:51 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c On Thu, Nov 17, 2011 at 10:13:41AM -0700, Vincent Danen wrote: > Our bind maintainer believes that 9.3.6 is affected (but possibly harder > to exploit or via a different vector). > > However, he does not believe that 9.2.x and earlier are affected due to > the old DNSSEC implementation (so 9.2.x wouldn't understand current > DNSSEC signatures so would not cache them). Thanks for the info! > Some further details can be found in our bug: > > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4313 This has Adam Tkac's comment about the patch for 9.3.x that I posted yesterday: "The patch is not 100% correct because 9.3.X version handles negative rdatasets differently. The rbtdb.c part of the patch uses RDATASET_ATTR_NEGATIVE attribute but this attribute is never set. However the query.c part of the patch is correct and in my opinion it's sufficient to prevent the crash." This confirms my understanding that the changes to rbtdb.c were a no-op in 9.3.x and it adds the opinion that the changes to query.c are both needed and sufficient to prevent the crash. So do we (distro vendors) choose to go ahead and release updates with just those changes for now? So far, I haven't heard a single report of 9.3.x crashing in the wild (ours are running fine, too, but most of them are built without DNSSEC), and several reports regarding newer versions crashing. It's a pity that we do not have a reproducer even though the crashes are happening in the wild. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.