nsd: CVE-2016-6173: Improper restriction of zone size limit

Debian Bug report logs - #830806
nsd: CVE-2016-6173: Improper restriction of zone size limit

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: nsd: CVE-2016-6173: Improper restriction of zone size limit

Date: Mon, 11 Jul 2016 20:30:58 +0200

Source: nsd
Version: 4.1.10-1
Severity: important
Tags: security upstream patch
Forwarded: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=790

Hi,

the following vulnerability was published for nsd.

CVE-2016-6173[0]:
Improper restriction of zone size limit

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-6173
[1] https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=790

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Message #10 received at 830806@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: Salvatore Bonaccorso <carnil@debian.org>, Debian Bug Tracking System <830806@bugs.debian.org>

Subject: Re: [Pkg-dns-devel] Bug#830806: nsd: CVE-2016-6173: Improper restriction of zone size limit

Date: Mon, 11 Jul 2016 20:36:07 +0200

Hi Salvatore,

the common agreement between DNS Vendors (that includes me) is that this
shouldn't have been assigned CVE as it is an operational issue as you
have an established trust between DNS master-slave for transfers. (And
all DNS servers are affected.)

I don't think this really needs update in stable, but I would like to
hear whether you think otherwise.

Cheers,
-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Potřeby pro pečení chleba
všeho druhu

On Mon, Jul 11, 2016, at 20:30, Salvatore Bonaccorso wrote:
> Source: nsd
> Version: 4.1.10-1
> Severity: important
> Tags: security upstream patch
> Forwarded: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=790
> 
> Hi,
> 
> the following vulnerability was published for nsd.
> 
> CVE-2016-6173[0]:
> Improper restriction of zone size limit
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2016-6173
> [1] https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=790
> 
> Please adjust the affected versions in the BTS as needed.
> 
> Regards,
> Salvatore
> 
> -- System Information:
> Debian Release: stretch/sid
>   APT prefers unstable
>   APT policy: (500, 'unstable'), (1, 'experimental')
> Architecture: amd64 (x86_64)
> 
> Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
> Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
> Init: systemd (via /run/systemd/system)
> 
> _______________________________________________
> pkg-dns-devel mailing list
> pkg-dns-devel@lists.alioth.debian.org
> https://lists.alioth.debian.org/mailman/listinfo/pkg-dns-devel

Message #17 received at 830806@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Ondřej Surý <ondrej@sury.org>

Cc: Debian Bug Tracking System <830806@bugs.debian.org>

Subject: Re: [Pkg-dns-devel] Bug#830806: nsd: CVE-2016-6173: Improper restriction of zone size limit

Date: Mon, 11 Jul 2016 20:48:41 +0200

Hi Ondrej,

On Mon, Jul 11, 2016 at 08:36:07PM +0200, Ondřej Surý wrote:
> Hi Salvatore,
> 
> the common agreement between DNS Vendors (that includes me) is that this
> shouldn't have been assigned CVE as it is an operational issue as you
> have an established trust between DNS master-slave for transfers. (And
> all DNS servers are affected.)
> 
> I don't think this really needs update in stable, but I would like to
> hear whether you think otherwise.

No I completely agree, we actually have marked all those already as
no-dsa (for src:nsd, src:pdns, src:bind9 and src:knot). But filling
those as well in BTS to have the reference in BTS.

Thanks for your quick response, amazing :-)

Salvatore

Send a report that this bug log contains spam.