Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1096016 - (CVE-2014-3214) CVE-2014-3214 bind: assertion failure when using prefetch
CVE-2014-3214 bind: assertion failure when using prefetch
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20140508,repo...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-05-09 01:57 EDT by Murray McAllister
Modified: 2015-01-04 17:40 EST (History)
6 users (show)

See Also:
Fixed In Version: bind 9.10.0-P1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-05-09 02:25:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Murray McAllister 2014-05-09 01:57:33 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-3214 to
the following vulnerability:

Name: CVE-2014-3214
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3214
Assigned: 20140503
Reference: https://kb.isc.org/article/AA-01161

The prefetch implementation in named in ISC BIND 9.10.0, when a
recursive nameserver is enabled, allows remote attackers to cause a
denial of service (REQUIRE assertion failure and daemon exit) via a
DNS query that triggers a response with unspecified attributes.

The prefetch option was introduced in BIND 9.10.0b1:

https://kb.isc.org/article/AA-01138/81/BIND-9.10.0b1-Release-Notes.html

Based on the issue description, the fix is possibly this NULL check in query.c:

7646                                         dns_name_t *name;
7647                                         name = (fname != NULL) ? fname : tname;
7648                                         query_prefetch(client, name, rdataset);

The version of BIND in Red Hat Enterprise Linux is older than 9.10, and also does not contain query_prefetch()
Comment 1 Murray McAllister 2014-05-09 02:08:22 EDT
The affected functionality does not appear to be in bind10 in Fedora either.
Comment 2 Murray McAllister 2014-05-09 02:19:49 EDT
Statement:

Not vulnerable. This issue did not affect the versions of bind or bind97 as shipped with Red Hat Enterprise Linux 5, 6 and 7.
Comment 3 Tomáš Hozza 2014-05-12 02:59:43 EDT
(In reply to Murray McAllister from comment #1)
> The affected functionality does not appear to be in bind10 in Fedora either.

Note that bind10 is not BIND 9.10!
Comment 4 Vincent Danen 2014-11-25 12:31:53 EST
External References:

https://kb.isc.org/article/AA-01161/

Note You need to log in before you can comment on or make changes to this bug.