Bug 434876 (CVE-2012-4244)

Summary:	<net-dns/bind-9.9.1_p3: Resource Record Denial of Service Vulnerability (CVE-2012-4244)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	idl0r
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://kb.isc.org/article/AA-00778/74
Whiteboard:	B3 [glsa]
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2012-09-13 09:29:29 UTC

Description:

If a record with RDATA in excess of 65535 bytes is loaded into a nameserver, a subsequent query for that record will cause named to exit with an assertion failure.

Please Note: Versions of BIND 9.4 and 9.5 are also affected, but these branches are beyond their "end of life" (EOL) and no longer receive testing or security fixes from ISC. For current information on which versions are actively supported, please see http://www.isc.org/software/bind/versions.

Solution:
BIND 9 version 9.9.2, 9.9.1-P3

Comment 1 Christian Ruppert (idl0r) gentoo-dev

2012-09-13 17:56:58 UTC

Feel free to stabilize 9.9.1-P3.

Comment 2 Tim Sammut (RETIRED) gentoo-dev

2012-09-13 18:07:19 UTC

Thanks.

Arches, please test and mark stable:
=net-dns/bind-9.9.1_p3
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

Comment 3 Agostino Sarubbo gentoo-dev

2012-09-13 18:25:28 UTC

amd64 stable

Comment 4 Anthony Basile gentoo-dev

2012-09-13 23:18:48 UTC

stable arm ppc ppc64

Comment 5 Raúl Porcel (RETIRED) gentoo-dev

2012-09-15 18:15:42 UTC

alpha/arm/ia64/s390/sh/sparc stable and x86 is already stable

Comment 6 GLSAMaker/CVETool Bot gentoo-dev

2012-09-16 13:56:43 UTC

CVE-2012-4244 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4244):
  ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3,
  and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to
  cause a denial of service (assertion failure and named daemon exit) via a
  query for a long resource record.

Comment 7 Jeroen Roovers (RETIRED) gentoo-dev

2012-09-16 14:23:05 UTC

Stable for HPPA.

Comment 8 Sean Amoss (RETIRED) gentoo-dev

2012-09-19 10:25:01 UTC

Thanks, everyone.

GLSA vote: yes.

Comment 9 Tim Sammut (RETIRED) gentoo-dev

2012-09-20 23:42:34 UTC

GLSA Vote: yes, too. Added to existing draft.

Comment 10 GLSAMaker/CVETool Bot gentoo-dev

2012-09-24 00:30:52 UTC

This issue was resolved and addressed in
 GLSA 201209-04 at http://security.gentoo.org/glsa/glsa-201209-04.xml
by GLSA coordinator Sean Amoss (ackle).