Bug 1247361 (CVE-2015-5477)
| Summary: | CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | carnil, fweimer, jrusnack, mdshaikh, security-response-team, thozza, yohmura | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | bind 9.9.7-P2, bind 9.10.2-P3 | Doc Type: | Bug Fix | ||||
| Doc Text: |
A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named (functioning as an authoritative DNS server or a DNS resolver) exit unexpectedly with an assertion failure via a specially crafted DNS request packet.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-07-29 00:44:06 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1247369, 1247370, 1247371, 1247372, 1247373, 1247374, 1247754, 1247755, 1300758, 1300760, 1300761 | ||||||
| Bug Blocks: | 1247362 | ||||||
| Attachments: |
|
||||||
|
Description
Martin Prpič
2015-07-27 20:07:11 UTC
Created attachment 1056756 [details]
bind99-CVE-2015-5477.patch
Patch provided by upstream
Public now via upstream security advisory. External References: https://kb.isc.org/article/AA-01272 https://access.redhat.com/solutions/1548963 Created bind99 tracking bugs for this issue: Affects: fedora-22 [bug 1247755] Created bind tracking bugs for this issue: Affects: fedora-all [bug 1247754] Statement: (none) Upstream commit: https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=dbb064aa7972ef918d9a235b713108a4846cbb62 This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2015:1515 https://rhn.redhat.com/errata/RHSA-2015-1515.html This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2015:1514 https://rhn.redhat.com/errata/RHSA-2015-1514.html This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2015:1513 https://rhn.redhat.com/errata/RHSA-2015-1513.html bind-9.10.2-4.P3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. bind-9.9.6-10.P1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. bind99-9.9.7-6.P2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. (In reply to Vincent Danen from comment #14) > Statement: > > This issue affected the versions of bind as shipped with Red Hat Enterprise > Linux 4, 5, 6 and 7, and the versions of bind97 as shipped with Red Hat > Enterprise Linux 5. This is an important security update. When are the updated packages for RHEL 4 ELS going to be released? Thanks. This issue has been addressed in the following products: Red Hat Enterprise Linux 6.5 AUS - Server Only Red Hat Enterprise Linux 6.4 AUS - Server Only Via RHSA-2016:0078 https://rhn.redhat.com/errata/RHSA-2016-0078.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 EUS - Server and Compute Node Only Via RHSA-2016:0079 https://rhn.redhat.com/errata/RHSA-2016-0079.html |