bind: security bump to version 9.11.1-P2

PATCH New Peter Korsgaard 2 participants 3 messages Jul 2, 2017 – Jul 4, 2017

lore

Share & tools

lore

Peter Korsgaard

author

2017-07-02 15:01 UTC #0 lore raw

PATCH 1/1 bind: security bump to version 9.11.1-P2

Fixes the following security issues:

CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into:

* providing an AXFR of a zone to an unauthorized recipient
* accepting bogus NOTIFY packets

https://kb.isc.org/article/AA-01504/74/CVE-2017-3142

CVE-2017-3041: An error in TSIG authentication can permit unauthorized dynamic updates

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update.

https://kb.isc.org/article/AA-01503/74/CVE-2017-3143

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/bind/bind.hash | 4 ++--
 package/bind/bind.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

package/bind/bind.hash +2 -2

index 3f0dda531a..5dd15cb86b 100644
@@ -1,2 +1,2 @@
-# Verified from http://ftp.isc.org/isc/bind9/9.11.1-P1/bind-9.11.1-P1.tar.gz.sha256.asc
-sha256 6b1b3e88d51b8471bd6aee24a8cea70817e850a5901315dc506f9dde275ca638 bind-9.11.1-P1.tar.gz
+# Verified from http://ftp.isc.org/isc/bind9/9.11.1-P1/bind-9.11.1-P2.tar.gz.sha256.asc
+sha256 bf53c6431575ae1612ddef66d18ef9baf2a22d842fa5b0cadc971919fd81fea5 bind-9.11.1-P2.tar.gz

package/bind/bind.mk +1 -1

index b588eb5223..fd5369a3ea 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-BIND_VERSION = 9.11.1-P1
+BIND_VERSION = 9.11.1-P2
 BIND_SITE = ftp://ftp.isc.org/isc/bind9/$(BIND_VERSION)
 # bind does not support parallel builds.
 BIND_MAKE = $(MAKE1)

Signature · 1 line

2.11.0

Thomas Petazzoni

Applied

2017-07-02 21:51 UTC #1 lore raw

PATCH 1/1 bind: security bump to version 9.11.1-P2

Hello,

Quoted 24 lines · Peter Korsgaard

Fixes the following security issues:
CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into:
* providing an AXFR of a zone to an unauthorized recipient
* accepting bogus NOTIFY packets
https://kb.isc.org/article/AA-01504/74/CVE-2017-3142
CVE-2017-3041: An error in TSIG authentication can permit unauthorized dynamic updates
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update.

Quoted 7 lines

https://kb.isc.org/article/AA-01503/74/CVE-2017-3143
Signed-off-by Peter Korsgaard <[email protected]>
---
 package/bind/bind.hash | 4 ++--
 package/bind/bind.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

Applied to master, thanks.

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

Peter Korsgaard

author

2017-07-04 15:33 UTC #2 lore raw

PATCH 1/1 bind: security bump to version 9.11.1-P2

In reply to Peter Korsgaard

Quoted 20 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into:
* providing an AXFR of a zone to an unauthorized recipient
* accepting bogus NOTIFY packets
https://kb.isc.org/article/AA-01504/74/CVE-2017-3142
CVE-2017-3041: An error in TSIG authentication can permit unauthorized dynamic updates

Quoted 8 lines

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update.
https://kb.isc.org/article/AA-01503/74/CVE-2017-3143
Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x and 2017.05.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard