bind9: CVE-2016-2848: A packet with malformed options can trigger an assertion failure

Debian Bug report logs - #839051
bind9: CVE-2016-2848: A packet with malformed options can trigger an assertion failure

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: submit@bugs.debian.org

Subject: bind9: Unfixed crasher bug in wheezy LTS

Date: Wed, 28 Sep 2016 09:11:12 +0200

[Message part 1 (text/plain, inline)]

Package: bind9
Version: 1:9.8.4.dfsg.P1-6+nmu2+deb7u10
Tags: security wheezy
Severity: grave

The wheezy LTS version of bind9 has an additional crasher bug.  It may
be due to an incomplete backport of the fix for CVE-2015-5477.  I'm
attaching the reproducer.

Upstream BIND without the fix for CVE-2016-2776 is *not* affected by
this issue, so it is something else.

[bind9.pl (text/x-perl, attachment)]

Message #10 received at 839051@bugs.debian.org (full text, mbox, reply):

From: Thorsten Alteholz <debian@alteholz.de>

To: Florian Weimer <fw@deneb.enyo.de>

Cc: debian-lts@lists.debian.org, 839051@bugs.debian.org

Subject: Re: wheezy-specific bind9 issue

Date: Tue, 4 Oct 2016 19:52:30 +0200 (CEST)

Hi Florian,

On Wed, 28 Sep 2016, Florian Weimer wrote:

> While trying to write a reproducer for CVE-2016-2776, I discovered
> that the 1:9.8.4.dfsg.P1-6+nmu2+deb7u10 version in wheezy would crash,
> while unpatched jessie and upstream would not:
>
>  <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839051>
>
> This might be due to an incomplete fix for CVE-2015-5477.  If the
> entire fix is missing, you can probably reuse the CVE ID.  If not,
> please let us know, and we'll assign a new ID once you have a patch.

according to [1] the fix for CVE-2015-5477 is just one line, which is 
applied correctly in 9.8.4.dfsg.P1-6+nmu2+deb7u6.
Also 9.8.4.dfsg.P1-6+nmu2+deb7u2 crashes as well with your script, so this 
seems to be a different problem.

  Thorsten

[1] https://kb.isc.org/getAttach/118/AA-01272/cve-2015-5477.patch.txt

Message #15 received at 839051@bugs.debian.org (full text, mbox, reply):

From: "Shaun Bugler - Hetzner (Pty) Ltd" <sb@hetzner.co.za>

To: debian-lts@lists.debian.org

Cc: 839051@bugs.debian.org

Subject: Re: wheezy-specific bind9 issue

Date: Thu, 6 Oct 2016 12:24:36 +0200

On 04/10/2016 19:52, Thorsten Alteholz wrote:
> Hi Florian,
>
> On Wed, 28 Sep 2016, Florian Weimer wrote:
>
>> While trying to write a reproducer for CVE-2016-2776, I discovered
>> that the 1:9.8.4.dfsg.P1-6+nmu2+deb7u10 version in wheezy would crash,
>> while unpatched jessie and upstream would not:
>>
>>  <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839051>
>>
>> This might be due to an incomplete fix for CVE-2015-5477.  If the
>> entire fix is missing, you can probably reuse the CVE ID.  If not,
>> please let us know, and we'll assign a new ID once you have a patch.
>
> according to [1] the fix for CVE-2015-5477 is just one line, which is 
> applied correctly in 9.8.4.dfsg.P1-6+nmu2+deb7u6.
> Also 9.8.4.dfsg.P1-6+nmu2+deb7u2 crashes as well with your script, so 
> this seems to be a different problem.
>
>   Thorsten
>
> [1] https://kb.isc.org/getAttach/118/AA-01272/cve-2015-5477.patch.txt
>
>
I think we are dealing with a different problem here, as Thorsten says 
the patch for CVE-2015-5477 seems to be applied correctly in code, yet
9.8.4.dfsg.P1-6+nmu2+deb7u11 is still affected:
http://pastebin.com/2hV7vdzg

The version in jessie ,9.9.5.dfsg-9+deb8u7, is unaffected.

Shaun

Message #30 received at 839051-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 839051-submitter@bugs.debian.org

Subject: retitle 839051 to bind9: A packet with malformed options can trigger an assertion failure ...

Date: Thu, 20 Oct 2016 20:21:14 +0200

retitle 839051 bind9: A packet with malformed options can trigger an assertion failure
found 839051 1:9.8.4.dfsg.P1-6
tags 839051 + upstream fixed-upstream
close 839051 1:9.9.3.dfsg.P2-1
thanks

Send a report that this bug log contains spam.