Bug 1378380 (CVE-2016-2776)

Summary: CVE-2016-2776 bind: assertion failure in buffer.c while building responses to a specifically constructed request
Product: [Other] Security Response Reporter: Dhiru Kholia <dkholia>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: fweimer, jeharris, jrusnack, mdshaikh, mjc, security-response-team, slawomir, thozza, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: bind 9.9.9-P3, bind 9.10.4-P3 Doc Type: If docs needed, set a value
Doc Text:
A denial of service flaw was found in the way BIND constructed a response to a query that met certain criteria. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS request packet.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-28 20:03:24 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1379214, 1379215, 1379219, 1379220, 1379247, 1379249, 1379818, 1379819, 1384591, 1384592, 1384593, 1384594, 1384808, 1429957    
Bug Blocks: 1378299    

Description Dhiru Kholia 2016-09-22 10:11:33 UTC
The following flaw, reported by ISC, was found in all versions of BIND 9 (9.0.x -> 9.8.x, 9.9.0->9.9.9-P2, 9.9.3-S1->9.9.9-S3,9.10.0->9.10.4-P2):

A defect in the rendering of messages into packets can cause named to exit with an assertion failure in buffer.c while constructing a response to a query that meets certain criteria.

This assertion can be triggered even if the apparent source address isn't allowed to make queries (i.e. doesn't match 'allow-query').

This flaw is fixed in upstream versions 9.9.9-P3 and 9.10.4-P3.

Comment 1 Dhiru Kholia 2016-09-22 10:11:41 UTC
Acknowledgments:

Name: ISC

Comment 8 Martin Prpič 2016-09-27 18:08:24 UTC
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1379818]

Comment 9 Martin Prpič 2016-09-27 18:08:31 UTC
Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1379819]

Comment 10 Martin Prpič 2016-09-27 18:08:56 UTC
External References:

https://kb.isc.org/article/AA-01419/0

Comment 11 errata-xmlrpc 2016-09-28 11:23:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2016:1945 https://rhn.redhat.com/errata/RHSA-2016-1945.html

Comment 12 errata-xmlrpc 2016-09-28 13:37:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2016:1944 https://rhn.redhat.com/errata/RHSA-2016-1944.html

Comment 17 errata-xmlrpc 2016-10-25 08:47:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support
  Red Hat Enterprise Linux 6.6 Extended Update Support
  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.4 Advanced Update Support
  Red Hat Enterprise Linux 6.2 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support

Via RHSA-2016:2099 https://rhn.redhat.com/errata/RHSA-2016-2099.html