Bug 1411348 (CVE-2016-9131) - CVE-2016-9131 bind: assertion failure while processing response to an ANY query
Summary: CVE-2016-9131 bind: assertion failure while processing response to an ANY query
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-9131
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: Petr Sklenar
URL:
Whiteboard:
Depends On: 1411417 1411418 1412459 1412460 1457194
Blocks: 1411339
TreeView+ depends on / blocked
 
Reported: 2017-01-09 14:33 UTC by Dhiru Kholia
Modified: 2019-09-29 14:03 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.
Clone Of:
Environment:
Last Closed: 2017-07-25 20:44:23 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0062 normal SHIPPED_LIVE Important: bind security update 2017-01-16 10:51:03 UTC
Red Hat Product Errata RHSA-2017:1583 normal SHIPPED_LIVE Important: bind security and bug fix update 2017-06-28 13:00:18 UTC

Description Dhiru Kholia 2017-01-09 14:33:27 UTC
A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties, after having engineered a scenario whereby an ANY query is sent to the recursive server for the target QNAME. A recursive server will itself only send a query of type ANY if it receives a client query of type ANY for a QNAME for which it has no RRsets at all in cache, otherwise it will respond to the client with the the RRsets that it has available.

This vulnerability occurs during the processing of an answer packet received in response to a query. As a result, recursive servers are at the greatest risk; authoritative servers are at risk only to the extent that they perform a limited set of queries.

This description is borrowed from the upstream advisory.

Comment 1 Dhiru Kholia 2017-01-09 14:33:36 UTC
Acknowledgments:

Name: ISC

Comment 4 Dhiru Kholia 2017-01-12 05:16:08 UTC
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1412459]

Comment 5 Dhiru Kholia 2017-01-12 05:16:14 UTC
Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1412460]

Comment 6 Dhiru Kholia 2017-01-12 05:16:56 UTC
External References:

https://kb.isc.org/article/AA-01439

Comment 7 errata-xmlrpc 2017-01-16 05:51:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0062 https://rhn.redhat.com/errata/RHSA-2017-0062.html

Comment 9 errata-xmlrpc 2017-06-28 09:01:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:1583 https://access.redhat.com/errata/RHSA-2017:1583


Note You need to log in before you can comment on or make changes to this bug.