CVE-2020-8624: update-policy rules of type subdomain are enforced incorrectly

Debian Bug report logs - #966497
CVE-2020-8624: update-policy rules of type subdomain are enforced incorrectly

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Joop Boonen <joop.boonen@credativ.de>

To: submit@bugs.debian.org

Subject: Buster: update-policy { grant dev.DOMAIN.TLD subdomain dev.DOMAIN.TLD a aaaa txt; } is not handled correctly

Date: Wed, 29 Jul 2020 13:17:03 +0200

[Message part 1 (text/plain, inline)]

Package: bind9
Version: 1:9.11.5.P4+dfsg-5.1+deb10u1

Problem:
update-policy { grant dev.DOMAIN.TLD subdomain dev.DOMAIN.TLD a aaaa txt; } is 
not handled correctly

Debian Stretch (9.10.3) doesn't have this issue. 

It is also possible to change entries in DOMAIN.TLD

Configuration part:

include "/etc/bind/dev.key";

zone DOMAIN.TLD {
	type master;
	file "/var/lib/bind/zones/DOMAIN.TLD";
	key-directory "/var/lib/bind/keys";
	masterfile-format raw;
	update-policy {
		grant dhcp zonesub a dhcid;
		grant local-ddns zonesub any;
                grant dev.DOMAIN.TLD subdomain dev.DOMAIN.TLD a aaaa txt;
	};

	allow-transfer {
		local;
	};
};

nsupdate key:

cat /etc/bind/dev.key 
key "dev.DOMAIN.TLD" {
	algorithm hmac-sha512;
	secret "******";
};


What is seen on Debian Buster:

nsupdate -k dev.key
> server 192.168.122.129
> ttl 3600
> update add test3.dev.DOMAIN.TLD a 192.0.2.3
> send
> update add test.DOMAIN.TLD a 192.0.2.1
> send

Logging: 
Jul 28 16:48:59 debian10-bind named[5894]: client @0x7f5718000c80 
192.168.122.1#40886/key dev.DOMAIN.TLD: updating zone 'DOMAIN.de/IN': adding 
an RR at 'test3.dev.DOMAIN.de' A 192.0.2.3
Jul 28 16:48:59 debain10-bind named[5894]: zone DOMAIN.de/IN: sending notifies 
(serial 2020050521)
Jul 28 16:49:07 debian10-bind named[5894]: client @0x7f5718000c80 
192.168.122.1#40886/key dev.DOMAIN.TLD: updating zone 'DOMAIN.de/IN': adding 
an RR at 'test.DOMAIN.de' A 192.0.2.1
Jul 28 16:49:07 debian10-bind named[5894]: zone DOMAIN.de/IN: sending notifies 
(serial 2020050522)


How it should look like, Debian Stretch:

nsupdate -k dev.key
> server 192.168.122.40
> ttl 3600
> update add test5.dev.credativ.de a 192.0.2.5   
> send
> update add test5.credativ.de a 192.0.2.5
> send
update failed: REFUSED

Logging:
Jul 29 11:37:00 debian9-bind named[515]: client 192.168.122.1#49684/key 
dev.credativ.de: updating zone 'credativ.de/IN': adding an RR at 
'test5.dev.credativ.de' A 192.0.2.5
Jul 29 11:37:00 debian9-bind named[515]: zone credativ.de/IN: sending notifies 
(serial 2020050522)
Jul 29 11:37:16 debian9-bind named[515]: client 192.168.122.1#49684/key 
dev.credativ.de: updating zone 'credativ.de/IN': update failed: rejected by 
secure update (REFUSED)


A isc issue (bug report) has been created: https://gitlab.isc.org/isc-projects/bind9/-/issues/2055

Regards,
 
Joop Boonen

Tel.: +49 2166 9901-0
Fax: +49 2166 9901-100
E-Mail: joop.boonen@credativ.de
pgp fingerprint: 9130 2E95 0D0E 1721 EB23 7270 C2C6 B28E 7EA7 F0A4
https://www.credativ.de
credativ GmbH, HRB Mönchengladbach 12080
USt-ID-Nummer: DE204566209
Trompeterallee 108, 41189 Mönchengladbach
Geschäftsführung: Dr. Michael Meskes, Jörg Folz, Sascha Heuer
Unser Umgang mit personenbezogenen Daten unterliegt
folgenden Bestimmungen: https://www.credativ.de/datenschutz
**********************************************
Jetzt neu: 
Elephant Shed - PostgreSQL Appliance
PostgreSQL und alles was dazugehört
Von Backup über Monitoring bis Reporting: 
https://elephant-shed.io/index.de.html
**********************************************

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.