Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 478316 (CVE-2013-4854)

Summary: <net-dns/bind-{9.9.3_p2, 9.8.5_p2} A specially crafted query can cause BIND to terminate abnormally (CVE-2013-4854)
Product: Gentoo Security Reporter: dwfreed <dwfreed>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: axiator, hendrik, idl0r, mr.jarry, toto, xmw
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://kb.isc.org/article/AA-01015
Whiteboard: B3 [glsa]
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 476034    
Attachments:
Description Flags
ebuild for Bind 9.9.3_p2
none
bind-9.9.3_p2.ebuild.patch none

Description dwfreed 2013-07-27 05:04:35 UTC
From the URL:

A specially crafted query that includes malformed rdata can cause named to terminate with an assertion failure while rejecting the malformed query.

Solution:

BIND 9 version 9.8.5-P2 and 9.9.3-P2 have been released to resolve this.
Comment 1 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2013-07-28 12:36:49 UTC
*** Bug 478464 has been marked as a duplicate of this bug. ***
Comment 2 Andrew Hamilton 2013-07-29 02:10:44 UTC
Created attachment 354474 [details]
ebuild for Bind 9.9.3_p2

Here is an ebuild for Bind 9.9.3_p2; the only change I had to make was to remove the patch for bug 463626 which was added upstream.

I built and tested this ebuild using a minimal set of use flags and I also built but did not extensively test a more full-featured build with most of the database backends enabled.
Comment 3 Michael Weber (RETIRED) gentoo-dev 2013-07-29 21:31:33 UTC
Created attachment 354554 [details, diff]
bind-9.9.3_p2.ebuild.patch

Please submit diffs.

Why:
 - stable keywords?
 - no newstats/ecdsa?
 - no systemd unit file?
 - no generate-rndc-key.sh?
Comment 4 Christian Ruppert (idl0r) archtester Gentoo Infrastructure gentoo-dev Security 2013-07-30 14:10:54 UTC
9.9.3-P2 has been added yesterday. Feel free to stabilize.
Comment 5 Agostino Sarubbo gentoo-dev 2013-07-30 14:16:10 UTC
Arches, please test and mark stable:
=net-dns/bind-9.9.3_p2
=net-dns/bind-tools-9.9.3_p2
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 6 Jeroen Roovers gentoo-dev 2013-07-30 19:44:46 UTC
Stable for HPPA.
Comment 7 Agostino Sarubbo gentoo-dev 2013-08-01 12:59:42 UTC
alpha stable
Comment 8 Agostino Sarubbo gentoo-dev 2013-08-01 13:00:11 UTC
amd64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-08-01 13:00:38 UTC
ia64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2013-08-01 13:01:05 UTC
ppc64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2013-08-01 13:01:33 UTC
ppc stable
Comment 12 Agostino Sarubbo gentoo-dev 2013-08-01 13:02:03 UTC
sparc stable
Comment 13 Agostino Sarubbo gentoo-dev 2013-08-01 13:02:30 UTC
x86 stable
Comment 14 Agostino Sarubbo gentoo-dev 2013-08-06 12:33:46 UTC
s390 stable
Comment 15 Agostino Sarubbo gentoo-dev 2013-08-08 12:37:35 UTC
sh stable
Comment 16 Agostino Sarubbo gentoo-dev 2013-08-09 14:58:43 UTC
arm stable
Comment 17 Sergey Popov gentoo-dev 2013-08-24 08:33:03 UTC
GLSA vote: yes
Comment 18 GLSAMaker/CVETool Bot gentoo-dev 2013-08-27 02:53:15 UTC
CVE-2013-4854 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4854):
  The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before
  9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND
  9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause
  a denial of service (assertion failure and named daemon exit) via a query
  with a malformed RDATA section that is not properly handled during
  construction of a log message, as exploited in the wild in July 2013.
Comment 19 Tobias Heinlein (RETIRED) gentoo-dev 2013-09-03 16:55:34 UTC
Added to existing request.
Comment 20 GLSAMaker/CVETool Bot gentoo-dev 2014-01-29 22:52:49 UTC
This issue was resolved and addressed in
 GLSA 201401-34 at http://security.gentoo.org/glsa/glsa-201401-34.xml
by GLSA coordinator Sean Amoss (ackle).