Bug 1096016 (CVE-2014-3214)

Summary: CVE-2014-3214 bind: assertion failure when using prefetch
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: jkurik, jpopelka, psimerda, thozza, vdanen, vonsch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: bind 9.10.0-P1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-05-09 06:25:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Murray McAllister 2014-05-09 05:57:33 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-3214 to
the following vulnerability:

Name: CVE-2014-3214
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3214
Assigned: 20140503
Reference: https://kb.isc.org/article/AA-01161

The prefetch implementation in named in ISC BIND 9.10.0, when a
recursive nameserver is enabled, allows remote attackers to cause a
denial of service (REQUIRE assertion failure and daemon exit) via a
DNS query that triggers a response with unspecified attributes.

The prefetch option was introduced in BIND 9.10.0b1:

https://kb.isc.org/article/AA-01138/81/BIND-9.10.0b1-Release-Notes.html

Based on the issue description, the fix is possibly this NULL check in query.c:

7646                                         dns_name_t *name;
7647                                         name = (fname != NULL) ? fname : tname;
7648                                         query_prefetch(client, name, rdataset);

The version of BIND in Red Hat Enterprise Linux is older than 9.10, and also does not contain query_prefetch()
Comment 1 Murray McAllister 2014-05-09 06:08:22 UTC 
The affected functionality does not appear to be in bind10 in Fedora either.
Comment 2 Murray McAllister 2014-05-09 06:19:49 UTC 
Statement:

Not vulnerable. This issue did not affect the versions of bind or bind97 as shipped with Red Hat Enterprise Linux 5, 6 and 7.
Comment 3 Tomáš Hozza 2014-05-12 06:59:43 UTC 
(In reply to Murray McAllister from comment #1)
> The affected functionality does not appear to be in bind10 in Fedora either.

Note that bind10 is not BIND 9.10!
Comment 4 Vincent Danen 2014-11-25 17:31:53 UTC 
External References:

https://kb.isc.org/article/AA-01161/