Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 478316 (CVE-2013-4854) - <net-dns/bind-{9.9.3_p2, 9.8.5_p2} A specially crafted query can cause BIND to terminate abnormally (CVE-2013-4854)
Summary: <net-dns/bind-{9.9.3_p2, 9.8.5_p2} A specially crafted query can cause BIND t...
Status: RESOLVED FIXED
Alias: CVE-2013-4854
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://kb.isc.org/article/AA-01015
Whiteboard: B3 [glsa]
Keywords:
: 478464 (view as bug list)
Depends on:
Blocks: unit-in-stable
  Show dependency tree
 
Reported: 2013-07-27 05:04 UTC by dwfreed
Modified: 2014-01-29 22:52 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
ebuild for Bind 9.9.3_p2 (bind-9.9.3_p2.ebuild,13.16 KB, text/plain)
2013-07-29 02:10 UTC, Andrew Hamilton
no flags Details
bind-9.9.3_p2.ebuild.patch (bind-9.9.3_p2.ebuild.patch,2.82 KB, patch)
2013-07-29 21:31 UTC, Michael Weber (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description dwfreed 2013-07-27 05:04:35 UTC
From the URL:

A specially crafted query that includes malformed rdata can cause named to terminate with an assertion failure while rejecting the malformed query.

Solution:

BIND 9 version 9.8.5-P2 and 9.9.3-P2 have been released to resolve this.
Comment 1 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2013-07-28 12:36:49 UTC
*** Bug 478464 has been marked as a duplicate of this bug. ***
Comment 2 Andrew Hamilton 2013-07-29 02:10:44 UTC
Created attachment 354474 [details]
ebuild for Bind 9.9.3_p2

Here is an ebuild for Bind 9.9.3_p2; the only change I had to make was to remove the patch for bug 463626 which was added upstream.

I built and tested this ebuild using a minimal set of use flags and I also built but did not extensively test a more full-featured build with most of the database backends enabled.
Comment 3 Michael Weber (RETIRED) gentoo-dev 2013-07-29 21:31:33 UTC
Created attachment 354554 [details, diff]
bind-9.9.3_p2.ebuild.patch

Please submit diffs.

Why:
 - stable keywords?
 - no newstats/ecdsa?
 - no systemd unit file?
 - no generate-rndc-key.sh?
Comment 4 Christian Ruppert (idl0r) archtester Gentoo Infrastructure gentoo-dev Security 2013-07-30 14:10:54 UTC
9.9.3-P2 has been added yesterday. Feel free to stabilize.
Comment 5 Agostino Sarubbo gentoo-dev 2013-07-30 14:16:10 UTC
Arches, please test and mark stable:
=net-dns/bind-9.9.3_p2
=net-dns/bind-tools-9.9.3_p2
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 6 Jeroen Roovers gentoo-dev 2013-07-30 19:44:46 UTC
Stable for HPPA.
Comment 7 Agostino Sarubbo gentoo-dev 2013-08-01 12:59:42 UTC
alpha stable
Comment 8 Agostino Sarubbo gentoo-dev 2013-08-01 13:00:11 UTC
amd64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-08-01 13:00:38 UTC
ia64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2013-08-01 13:01:05 UTC
ppc64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2013-08-01 13:01:33 UTC
ppc stable
Comment 12 Agostino Sarubbo gentoo-dev 2013-08-01 13:02:03 UTC
sparc stable
Comment 13 Agostino Sarubbo gentoo-dev 2013-08-01 13:02:30 UTC
x86 stable
Comment 14 Agostino Sarubbo gentoo-dev 2013-08-06 12:33:46 UTC
s390 stable
Comment 15 Agostino Sarubbo gentoo-dev 2013-08-08 12:37:35 UTC
sh stable
Comment 16 Agostino Sarubbo gentoo-dev 2013-08-09 14:58:43 UTC
arm stable
Comment 17 Sergey Popov gentoo-dev 2013-08-24 08:33:03 UTC
GLSA vote: yes
Comment 18 GLSAMaker/CVETool Bot gentoo-dev 2013-08-27 02:53:15 UTC
CVE-2013-4854 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4854):
  The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before
  9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND
  9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause
  a denial of service (assertion failure and named daemon exit) via a query
  with a malformed RDATA section that is not properly handled during
  construction of a log message, as exploited in the wild in July 2013.
Comment 19 Tobias Heinlein (RETIRED) gentoo-dev 2013-09-03 16:55:34 UTC
Added to existing request.
Comment 20 GLSAMaker/CVETool Bot gentoo-dev 2014-01-29 22:52:49 UTC
This issue was resolved and addressed in
 GLSA 201401-34 at http://security.gentoo.org/glsa/glsa-201401-34.xml
by GLSA coordinator Sean Amoss (ackle).