bind: backport six CVE patches

new file mode 100644
index 0000000..0abb475
@@ -0,0 +1,119 @@
+bind_Fix_for_CVE-2012-5166
+
+Upstream-Status: Backport
+
+Reference:http://launchpadlibrarian.net/119212498/bind9_1%3A9.7.3.dfsOBg
+-1ubuntu2.6_1%3A9.7.3.dfsg-1ubuntu2.7.diff.gz
+
+ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before
+9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows
+remote attackers to cause a denial of service (named daemon hang)
+via unspecified combinations of resource records.
+
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5166
+
+Signed-off-by: yanjun.zhu <[email protected]>
+diff -urpN a/bin/named/query.c b/bin/named/query.c
+--- a/bin/named/query.c	2012-10-22 13:24:27.000000000 +0800
++++ b/bin/named/query.c	2012-10-22 13:17:04.000000000 +0800
+@@ -1137,13 +1137,6 @@ query_isduplicate(ns_client_t *client, d
+ 		mname = NULL;
+ 	}
+ 
+-	/*
+-	 * If the dns_name_t we're looking up is already in the message,
+-	 * we don't want to trigger the caller's name replacement logic.
+-	 */
+-	if (name == mname)
+-		mname = NULL;
+-
+ 	*mnamep = mname;
+ 
+ 	CTRACE("query_isduplicate: false: done");
+@@ -1341,6 +1334,7 @@ query_addadditional(void *arg, dns_name_
+ 	if (dns_rdataset_isassociated(rdataset) &&
+ 	    !query_isduplicate(client, fname, type, &mname)) {
+ 		if (mname != NULL) {
++			INSIST(mname != fname);
+ 			query_releasename(client, &fname);
+ 			fname = mname;
+ 		} else
+@@ -1401,11 +1395,13 @@ query_addadditional(void *arg, dns_name_
+ 			mname = NULL;
+ 			if (!query_isduplicate(client, fname,
+ 					       dns_rdatatype_a, &mname)) {
+-				if (mname != NULL) {
+-					query_releasename(client, &fname);
+-					fname = mname;
+-				} else
+-					need_addname = ISC_TRUE;
++				if (mname != fname) {
++					if (mname != NULL) {
++						query_releasename(client, &fname);
++						fname = mname;
++					} else
++						need_addname = ISC_TRUE;
++				}
+ 				ISC_LIST_APPEND(fname->list, rdataset, link);
+ 				added_something = ISC_TRUE;
+ 				if (sigrdataset != NULL &&
+@@ -1444,11 +1440,13 @@ query_addadditional(void *arg, dns_name_
+ 			mname = NULL;
+ 			if (!query_isduplicate(client, fname,
+ 					       dns_rdatatype_aaaa, &mname)) {
+-				if (mname != NULL) {
+-					query_releasename(client, &fname);
+-					fname = mname;
+-				} else
+-					need_addname = ISC_TRUE;
++				if (mname != fname) {
++					if (mname != NULL) {
++						query_releasename(client, &fname);
++						fname = mname;
++					} else
++						need_addname = ISC_TRUE;
++				}
+ 				ISC_LIST_APPEND(fname->list, rdataset, link);
+ 				added_something = ISC_TRUE;
+ 				if (sigrdataset != NULL &&
+@@ -1960,22 +1958,24 @@ query_addadditional2(void *arg, dns_name
+ 		    crdataset->type == dns_rdatatype_aaaa) {
+ 			if (!query_isduplicate(client, fname, crdataset->type,
+ 					       &mname)) {
+-				if (mname != NULL) {
+-					/*
+-					 * A different type of this name is
+-					 * already stored in the additional
+-					 * section.  We'll reuse the name.
+-					 * Note that this should happen at most
+-					 * once.  Otherwise, fname->link could
+-					 * leak below.
+-					 */
+-					INSIST(mname0 == NULL);
+-
+-					query_releasename(client, &fname);
+-					fname = mname;
+-					mname0 = mname;
+-				} else
+-					need_addname = ISC_TRUE;
++				if (mname != fname) {
++					if (mname != NULL) {
++						/*
++						 * A different type of this name is
++						 * already stored in the additional
++						 * section.  We'll reuse the name.
++						 * Note that this should happen at most
++						 * once.  Otherwise, fname->link could
++						 * leak below.
++						 */
++						INSIST(mname0 == NULL);
++
++						query_releasename(client, &fname);
++						fname = mname;
++						mname0 = mname;
++					} else
++						need_addname = ISC_TRUE;
++				}
+ 				ISC_LIST_UNLINK(cfname.list, crdataset, link);
+ 				ISC_LIST_APPEND(fname->list, crdataset, link);
+ 				added_something = ISC_TRUE;

89 lines not on this page · raw message

92 lines not on this page · raw message

new file mode 100644
index 0000000..1e159bd
@@ -0,0 +1,40 @@
+bind: fix for CVE-2012-3817
+
+Upstream-Status: Backport
+
+ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2;
+9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation
+is enabled, does not properly initialize the failing-query cache, which allows
+remote attackers to cause a denial of service (assertion failure and daemon exit)
+by sending many queries.
+
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3817
+
+This patch is back-ported from bind-9.3.6-20.P1.el5_8.2.src.rpm package.
+
+Signed-off-by: Ming Liu <[email protected]>
+---
+ resolver.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -8318,6 +8318,7 @@ dns_resolver_addbadcache(dns_resolver_t 
+ 			goto cleanup;
+ 		bad->type = type;
+ 		bad->hashval = hashval;
++		bad->expire = *expire;
+ 		isc_buffer_init(&buffer, bad + 1, name->length);
+ 		dns_name_init(&bad->name, NULL);
+ 		dns_name_copy(name, &bad->name, &buffer);
+@@ -8329,8 +8330,8 @@ dns_resolver_addbadcache(dns_resolver_t 
+ 		if (resolver->badcount < resolver->badhash * 2 &&
+ 		    resolver->badhash > DNS_BADCACHE_SIZE)
+ 			resizehash(resolver, &now, ISC_FALSE);
+-	}
+-	bad->expire = *expire;
++	} else
++		bad->expire = *expire;
+  cleanup:
+ 	UNLOCK(&resolver->lock);
+ }

41 lines not on this page · raw message

141 lines not on this page · raw message

index b807dbf..3c5d600 100644
@@ -12,6 +12,12 @@ SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
            file://conf.patch \
            file://cross-build-fix.patch \
            file://make-etc-initd-bind-stop-work.patch \
+           file://bind-9.8.1-CVE-2012-5166.patch \
+           file://bind-CVE-2011-4313.patch \
+           file://bind-CVE-2012-1667.patch \
+           file://bind-CVE-2012-3817.patch \
+           file://bind-CVE-2013-2266.patch \
+           file://bind-Fix-CVE-2012-4244.patch \
 	   "
 
 SRC_URI[md5sum] = "cf31117c5d35af34d4c0702970ad9fb7"