Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 598750 (CVE-2016-8864) - <net-dns/bind-9.10.4_p4: assert via DNAME can crash resolver (CVE-2016-8864)
Summary: <net-dns/bind-9.10.4_p4: assert via DNAME can crash resolver (CVE-2016-8864)
Status: RESOLVED FIXED
Alias: CVE-2016-8864
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://kb.isc.org/article/AA-01434
Whiteboard: A3 [glsa cve]
Keywords:
Depends on:
Blocks: CVE-2016-2776
  Show dependency tree
 
Reported: 2016-11-02 09:37 UTC by Hanno Böck
Modified: 2017-01-23 03:58 UTC (History)
3 users (show)

See Also:
Package list:
=net-dns/bind-9.10.4_p4 =net-dns/bind-tools-9.10.4_p4
Runtime testing required: ---
kensington: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hanno Böck gentoo-dev 2016-11-02 09:37:59 UTC 
From upstream advisory:
"A defect in BIND's handling of responses containing a DNAME answer can cause a resolver to exit after encountering an assertion failure in db.c or resolver.c"

Fixed upstream versions:
BIND 9 version 9.9.9-P4
BIND 9 version 9.10.4-P4
BIND 9 version 9.11.0-P1
Comment 1 Christian Ruppert (idl0r) gentoo-dev 2016-11-05 12:09:55 UTC 
bind and bind-tools 9.10.4_p4 has just been added.
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-11-11 06:38:14 UTC 
(In reply to Christian Ruppert (idl0r) from comment #1)
> bind and bind-tools 9.10.4_p4 has just been added.

Ready for stable?
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-28 17:49:18 UTC 
@ Arches,

please test and mark stable: =net-dns/bind-9.10.4_p4
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-28 17:51:27 UTC 
@ Arches,

please test and mark stable:

=net-dns/bind-9.10.4_p4
=net-dns/bind-tools-9.10.4_p4
Comment 5 Agostino Sarubbo gentoo-dev 2016-11-29 10:41:58 UTC 
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-11-29 10:44:20 UTC 
x86 stable
Comment 7 Markus Meier gentoo-dev 2016-11-30 19:37:16 UTC 
arm stable
Comment 8 Tobias Klausmann (RETIRED) gentoo-dev 2016-12-02 14:21:37 UTC 
Stable on alpha.
Comment 9 Agostino Sarubbo gentoo-dev 2016-12-19 14:38:53 UTC 
sparc stable
Comment 10 Agostino Sarubbo gentoo-dev 2016-12-19 15:15:29 UTC 
ia64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2016-12-20 09:48:33 UTC 
ppc stable
Comment 12 Agostino Sarubbo gentoo-dev 2016-12-22 09:37:20 UTC 
ppc64 stable
Comment 13 Aaron Bauman (RETIRED) gentoo-dev 2017-01-01 13:46:10 UTC 
hppa ping.
Comment 14 Jeroen Roovers (RETIRED) gentoo-dev 2017-01-09 13:43:06 UTC 
Stable for HPPA.
Comment 15 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-09 18:04:58 UTC 
New GLSA request filed.

@ Maintainer(s): Please cleanup <net-dns/bind-9.10.4_p4 and <net-dns/bind-tools-9.10.4_p4!
Comment 16 GLSAMaker/CVETool Bot gentoo-dev 2017-01-11 12:27:39 UTC 
This issue was resolved and addressed in
 GLSA 201701-26 at https://security.gentoo.org/glsa/201701-26
by GLSA coordinator Aaron Bauman (b-man).
Comment 17 Aaron Bauman (RETIRED) gentoo-dev 2017-01-11 12:28:20 UTC 
reopening for cleanup
Comment 18 Aaron Bauman (RETIRED) gentoo-dev 2017-01-23 03:58:34 UTC 
tree is clean.