Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c

[Solar Designer <solar () openwall com>]

On Thu, Nov 17, 2011 at 10:13:41AM -0700, Vincent Danen wrote:
> Our bind maintainer believes that 9.3.6 is affected (but possibly harder
> to exploit or via a different vector).
>
> However, he does not believe that 9.2.x and earlier are affected due to
> the old DNSSEC implementation (so 9.2.x wouldn't understand current
> DNSSEC signatures so would not cache them).

Thanks for the info!

> Some further details can be found in our bug:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4313

This has Adam Tkac's comment about the patch for 9.3.x that I posted
yesterday:

"The patch is not 100% correct because 9.3.X version handles negative rdatasets
differently. The rbtdb.c part of the patch uses RDATASET_ATTR_NEGATIVE
attribute but this attribute is never set. However the query.c part of the
patch is correct and in my opinion it's sufficient to prevent the crash."

This confirms my understanding that the changes to rbtdb.c were a no-op
in 9.3.x and it adds the opinion that the changes to query.c are both
needed and sufficient to prevent the crash.

So do we (distro vendors) choose to go ahead and release updates with
just those changes for now?

So far, I haven't heard a single report of 9.3.x crashing in the wild
(ours are running fine, too, but most of them are built without DNSSEC),
and several reports regarding newer versions crashing.

It's a pity that we do not have a reproducer even though the crashes are
happening in the wild.

Alexander