mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 22:45:39 +00:00
Code Issues Releases Wiki Activity

[master] fix rpz formerr loop

Browse Source 
4531.	[security]	Some RPZ configurations could go into an infinite
			query loop when encountering responses with TTL=0.
			(CVE-2017-3140) [RT #45181]
This commit is contained in:
Evan Hunt
2017-05-30 12:26:23 -07:00
parent aa3a8979bc
commit 2648c49be7
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
4531. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]
4530. [bug] "dyndb" is dependent on dlopen existing / being 4530. [bug] "dyndb" is dependent on dlopen existing / being
enabled. [RT #45291] enabled. [RT #45291]

4
bin/named/query.c
View File

@@ -6428,7 +6428,7 @@ query_respond(query_ctx_t *qctx) {
/* /*
* If we have a zero ttl from the cache, refetch. * If we have a zero ttl from the cache, refetch.
*/ */
if (!qctx->is_zone && qctx->event == NULL && if (!qctx->is_zone && !qctx->resuming &&
qctx->rdataset->ttl == 0 && RECURSIONOK(qctx->client)) qctx->rdataset->ttl == 0 && RECURSIONOK(qctx->client))
{ {
qctx_clean(qctx); qctx_clean(qctx);
@@ -7895,7 +7895,7 @@ query_cname(query_ctx_t *qctx) {
/* /*
* If we have a zero ttl from the cache refetch it. * If we have a zero ttl from the cache refetch it.
*/ */
if (!qctx->is_zone && qctx->event == NULL && if (!qctx->is_zone && !qctx->resuming &&
qctx->rdataset->ttl == 0 && RECURSIONOK(qctx->client)) qctx->rdataset->ttl == 0 && RECURSIONOK(qctx->client))
{ {
qctx_clean(qctx); qctx_clean(qctx);

8
doc/arm/notes.xml
View File

@@ -67,6 +67,14 @@
<section xml:id="relnotes_security"><info><title>Security Fixes</title></info> <section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
<itemizedlist> <itemizedlist>
<listitem>
<para>
With certain RPZ configurations, a response with TTL 0
could cause <command>named</command> to go into an infinite
query loop. This flaw is disclosed in CVE-2017-3140.
[RT #45181]
</para>
</listitem>
<listitem> <listitem>
<para> <para>
<command>rndc ""</command> could trigger an assertion failure <command>rndc ""</command> could trigger an assertion failure