pool/bind
SHA256
8
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- Update to version 9.10.3-P2 to fix a remote denial of service by

Browse Source 
misparsing incoming responses (CVE-2015-8000, bsc#958861).

OBS-URL: https://build.opensuse.org/package/show/network/bind?expand=0&rev=180
This commit is contained in:
Reinhard Max
2015-12-21 17:12:31 +00:00
committed by Git OBS Bridge
parent ee28860376
commit 5f956be5fc
7 changed files with 94 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
bind-9.10.2-P4.tar.gz
View File

@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:c00b21ec1def212957f28efe9d10aac52d6ec515e84fbf2c42143f5d71429cb8
size 8471531

11
bind-9.10.2-P4.tar.gz.asc
View File

@@ -1,11 +0,0 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (NetBSD)
iQEcBAABAgAGBQJV04QTAAoJEG+m68mRGkwCRvYH/19oF+kkXzg9V9Sdd2qrjrYf
PuFQQnEcP4Eodk+10i4AvW94K/5mVF5o0QAgLTpSpJpiMWyjwSWurD9/p663S2P2
N5bjW+gcNhV4F4mMMNE4432WX4+rs8XB9b45t5YyvpyOL0u4mhn82TYY4WazPQEy
mmRAn81rUuRUdBATdwuIEGNpastYvAxCzNbZR2uyv/uH1Llbb7DHdW78Vh0M7hq3
ypdm0jW5HQL3LLtX1Y3PFbMilfluCoWbreVz+I+/9WAYB5z4KspT3AJNDUWjhtZl
PeFxSbsHbSSD+ILSnGYB02lMum0YnVe5YFIHCTJXZIj53DtkzTF9xb70Q7tWyMY=
=3SxE
-----END PGP SIGNATURE-----

3
bind-9.10.3-P2.tar.gz Normal file
View File

@@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:4a6c1911ac0d4b6be635b63de3429b6c168ea244043f12bbc8a4eb3368fd6ecd
size 8523719

11
bind-9.10.3-P2.tar.gz.asc Normal file
View File

@@ -0,0 +1,11 @@
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
iQEcBAABAgAGBQJWZiOeAAoJEG+m68mRGkwCbw4H/2qwR/u6eg6yODs57kikyjRr
/3Cut1C2eaRS0nxk6kesw++VOqKTzDzeoQSsu+DEHfYq6fB/C8h4hA8mGZfRZ4P2
hUQ+wsSBnyN+VYbv4yVKVjae/6T4Pr2NgepfbKnBN037/eNHykO6a41aB1Gi3sUa
g4UTU2ZO2JXGo5JusWUGeV85xUC8zQXo8ZDTUIyaZELk/7Hp317gCMC+SJPNRLvM
+Ex9PYfArj8ovQ0y1XRoj1VGglZwBz9zN99nxPD320l8LApYsCROGqCIXJYWKfRw
EtKLO0/weIdCgGZp/7GilnEJKPICXyuDemoRIiParqwCHQMmPunwQa6eHXZ/Kjk=
=EpUm
-----END PGP SIGNATURE-----

6
bind.changes
View File

@@ -1,3 +1,9 @@
-------------------------------------------------------------------
Mon Dec 21 16:55:36 UTC 2015 - max@suse.com
- Update to version 9.10.3-P2 to fix a remote denial of service by
misparsing incoming responses (CVE-2015-8000, bsc#958861).
-------------------------------------------------------------------
Sun Oct 4 16:57:28 UTC 2015 - jengelh@inai.de

32
bind.spec
View File

@@ -18,8 +18,8 @@
Name: bind
%define pkg_name bind
%define pkg_vers 9.10.2-P4
%define rpm_vers 9.10.2P4
%define pkg_vers 9.10.3-P2
%define rpm_vers 9.10.3P2
%define idn_vers 1.0
Summary: Domain Name System (DNS) Server (named)
License: ISC
@@ -141,13 +141,13 @@ Release: 0
This library contains a few utility functions used by the BIND
server and utilities.
%package -n libdns161
%package -n libdns162
Summary: DNS library used by BIND
Group: System/Libraries
Version: %rpm_vers
Release: 0
%description -n libdns161
%description -n libdns162
This subpackage contains the "DNS client" module. This is a higher
level API that provides an interface to name resolution, single DNS
transaction with a particular server, and dynamic update. Regarding
@@ -227,7 +227,7 @@ libirs provides an interface to parse the traditional resolv.conf file and an
parameters that would be beyond the capability of the resolv.conf file. This
subpackage contains the header files needed for building programs with it.
%package -n libisc148
%package -n libisc160
Summary: ISC shared library used by BIND
Group: System/Libraries
Version: %rpm_vers
@@ -238,7 +238,7 @@ Release: 0
Obsoletes: bind-libs = %version-%release
Provides: bind-libs < %version-%release
%description -n libisc148
%description -n libisc160
This library contains miscellaneous utility function used by the BIND
server and utilities. It includes functions for assertion handling,
balanced binary (AVL) trees, bit masks comparison, event based
@@ -298,9 +298,9 @@ Group: Development/Libraries/C and C++
Version: %rpm_vers
Release: 0
Requires: libbind9-140 = %version
Requires: libdns161 = %version
Requires: libdns162 = %version
Requires: libirs141 = %version
Requires: libisc148 = %version
Requires: libisc160 = %version
Requires: libisccc140 = %version
Requires: libisccfg140 = %version
Requires: liblwres141 = %version
@@ -725,8 +725,8 @@ fi
%post -n libbind9-140 -p /sbin/ldconfig
%postun -n libbind9-140 -p /sbin/ldconfig
%post -n libdns161 -p /sbin/ldconfig
%postun -n libdns161 -p /sbin/ldconfig
%post -n libdns162 -p /sbin/ldconfig
%postun -n libdns162 -p /sbin/ldconfig
%post -n libidnkit1 -p /sbin/ldconfig
%postun -n libidnkit1 -p /sbin/ldconfig
%post -n libidnkitlite1 -p /sbin/ldconfig
@@ -735,8 +735,8 @@ fi
%postun -n libidnkitres1 -p /sbin/ldconfig
%post -n libirs141 -p /sbin/ldconfig
%postun -n libirs141 -p /sbin/ldconfig
%post -n libisc148 -p /sbin/ldconfig
%postun -n libisc148 -p /sbin/ldconfig
%post -n libisc160 -p /sbin/ldconfig
%postun -n libisc160 -p /sbin/ldconfig
%post -n libisccc140 -p /sbin/ldconfig
%postun -n libisccc140 -p /sbin/ldconfig
%post -n libisccfg140 -p /sbin/ldconfig
@@ -864,9 +864,9 @@ fi
%defattr(-,root,root)
%_libdir/libbind9.so.140*
%files -n libdns161
%files -n libdns162
%defattr(-,root,root)
%_libdir/libdns.so.161*
%_libdir/libdns.so.162*
%files -n libidnkit1
%defattr(-,root,root)
@@ -888,9 +888,9 @@ fi
%defattr(-,root,root)
%_libdir/libirs.so
%files -n libisc148
%files -n libisc160
%defattr(-,root,root)
%_libdir/libisc.so.148*
%_libdir/libisc.so.160*
%files -n libisccc140
%defattr(-,root,root)

106
dns_dynamic_db.patch
View File

@@ -7,9 +7,10 @@
#
# Based on the original patch, some minor adjustments to line numbers are made by Howard Guo <hguo@suse.com>.
diff -rupN bind-9.10.1-P1-orig/bin/named/main.c bind-9.10.1-P1-patched/bin/named/main.c
--- bind-9.10.1-P1-orig/bin/named/main.c 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/bin/named/main.c 2015-04-27 11:33:20.619196452 +0200
Index: bind-9.10.3-P2/bin/named/main.c
===================================================================
--- bind-9.10.3-P2.orig/bin/named/main.c
+++ bind-9.10.3-P2/bin/named/main.c
@@ -43,6 +43,7 @@
#include <isccc/result.h>
@@ -18,9 +19,10 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/main.c bind-9.10.1-P1-patched/bin/named
#include <dns/name.h>
#include <dns/result.h>
#include <dns/view.h>
diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/named/server.c
--- bind-9.10.1-P1-orig/bin/named/server.c 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/bin/named/server.c 2015-04-27 11:33:20.620196464 +0200
Index: bind-9.10.3-P2/bin/named/server.c
===================================================================
--- bind-9.10.3-P2.orig/bin/named/server.c
+++ bind-9.10.3-P2/bin/named/server.c
@@ -68,6 +68,7 @@
#include <dns/db.h>
#include <dns/dispatch.h>
@@ -29,7 +31,7 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/nam
#include <dns/dns64.h>
#include <dns/forward.h>
#include <dns/journal.h>
@@ -1304,6 +1305,72 @@ configure_peer(const cfg_obj_t *cpeer, i
@@ -1309,6 +1310,72 @@
}
static isc_result_t
@@ -102,15 +104,15 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/nam
disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
isc_result_t result;
const cfg_obj_t *algorithms;
@@ -2335,6 +2402,7 @@ configure_view(dns_view_t *view, dns_vie
@@ -2344,6 +2411,7 @@
const cfg_obj_t *dlz;
unsigned int dlzargc;
char **dlzargv;
+ const cfg_obj_t *dynamic_db_list;
const cfg_obj_t *disabled;
const cfg_obj_t *obj;
const cfg_listelt_t *element;
@@ -2611,6 +2679,8 @@ configure_view(dns_view_t *view, dns_vie
#ifdef ENABLE_FETCHLIMIT
@@ -2623,6 +2691,8 @@
}
}
@@ -119,7 +121,7 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/nam
/*
* Obtain configuration parameters that affect the decision of whether
* we can reuse/share an existing cache.
@@ -3613,6 +3683,37 @@ configure_view(dns_view_t *view, dns_vie
@@ -3698,6 +3768,37 @@
dns_view_setrootdelonly(view, ISC_FALSE);
/*
@@ -157,7 +159,7 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/nam
* Setup automatic empty zones. If recursion is off then
* they are disabled by default.
*/
@@ -5355,6 +5456,7 @@ load_configuration(const char *filename,
@@ -5443,6 +5544,7 @@
cfg_aclconfctx_detach(&ns_g_aclconfctx);
CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));
@@ -165,7 +167,7 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/nam
/*
* Parse the global default pseudo-config file.
*/
@@ -6562,6 +6664,8 @@ shutdown_server(isc_task_t *task, isc_ev
@@ -6671,6 +6773,8 @@
dns_view_detach(&view);
}
@@ -174,9 +176,10 @@ diff -rupN bind-9.10.1-P1-orig/bin/named/server.c bind-9.10.1-P1-patched/bin/nam
while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
ISC_LIST_UNLINK(server->cachelist, nsc, link);
dns_cache_detach(&nsc->cache);
diff -rupN bind-9.10.1-P1-orig/lib/dns/dynamic_db.c bind-9.10.1-P1-patched/lib/dns/dynamic_db.c
--- bind-9.10.1-P1-orig/lib/dns/dynamic_db.c 1970-01-01 01:00:00.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/dynamic_db.c 2015-04-27 11:33:20.620196464 +0200
Index: bind-9.10.3-P2/lib/dns/dynamic_db.c
===================================================================
--- /dev/null
+++ bind-9.10.3-P2/lib/dns/dynamic_db.c
@@ -0,0 +1,366 @@
+/*
+ * Copyright (C) 2008-2011 Red Hat, Inc.
@@ -544,9 +547,10 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/dynamic_db.c bind-9.10.1-P1-patched/lib/d
+
+ return args->timermgr;
+}
diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/dynamic_db.h bind-9.10.1-P1-patched/lib/dns/include/dns/dynamic_db.h
--- bind-9.10.1-P1-orig/lib/dns/include/dns/dynamic_db.h 1970-01-01 01:00:00.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/include/dns/dynamic_db.h 2015-04-27 11:33:20.620196464 +0200
Index: bind-9.10.3-P2/lib/dns/include/dns/dynamic_db.h
===================================================================
--- /dev/null
+++ bind-9.10.3-P2/lib/dns/include/dns/dynamic_db.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2008-2011 Red Hat, Inc.
@@ -598,10 +602,11 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/dynamic_db.h bind-9.10.1-P1-p
+isc_timermgr_t *dns_dyndb_get_timermgr(dns_dyndb_arguments_t *args);
+
+#endif
diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/log.h bind-9.10.1-P1-patched/lib/dns/include/dns/log.h
--- bind-9.10.1-P1-orig/lib/dns/include/dns/log.h 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/include/dns/log.h 2015-04-27 11:33:20.621196475 +0200
@@ -79,6 +79,7 @@ LIBDNS_EXTERNAL_DATA extern isc_logmodul
Index: bind-9.10.3-P2/lib/dns/include/dns/log.h
===================================================================
--- bind-9.10.3-P2.orig/lib/dns/include/dns/log.h
+++ bind-9.10.3-P2/lib/dns/include/dns/log.h
@@ -78,6 +78,7 @@
#define DNS_LOGMODULE_DNSSEC (&dns_modules[27])
#define DNS_LOGMODULE_CRYPTO (&dns_modules[28])
#define DNS_LOGMODULE_PACKETS (&dns_modules[29])
@@ -609,10 +614,11 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/log.h bind-9.10.1-P1-patched/
ISC_LANG_BEGINDECLS
diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/Makefile.in bind-9.10.1-P1-patched/lib/dns/include/dns/Makefile.in
--- bind-9.10.1-P1-orig/lib/dns/include/dns/Makefile.in 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/include/dns/Makefile.in 2015-04-27 11:33:20.621196475 +0200
@@ -23,7 +23,7 @@ top_srcdir = @top_srcdir@
Index: bind-9.10.3-P2/lib/dns/include/dns/Makefile.in
===================================================================
--- bind-9.10.3-P2.orig/lib/dns/include/dns/Makefile.in
+++ bind-9.10.3-P2/lib/dns/include/dns/Makefile.in
@@ -23,7 +23,7 @@
HEADERS = acache.h acl.h adb.h bit.h byaddr.h cache.h callbacks.h cert.h \
client.h clientinfo.h compress.h \
@@ -621,10 +627,11 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/Makefile.in bind-9.10.1-P1-pa
dlz.h dlz_dlopen.h dns64.h dnssec.h ds.h dsdigest.h \
ecdb.h events.h fixedname.h forward.h geoip.h iptable.h \
journal.h keydata.h keyflags.h keytable.h keyvalues.h \
diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/types.h bind-9.10.1-P1-patched/lib/dns/include/dns/types.h
--- bind-9.10.1-P1-orig/lib/dns/include/dns/types.h 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/include/dns/types.h 2015-04-27 11:33:20.621196475 +0200
@@ -139,6 +139,7 @@ typedef struct dns_zone dns_zone_t;
Index: bind-9.10.3-P2/lib/dns/include/dns/types.h
===================================================================
--- bind-9.10.3-P2.orig/lib/dns/include/dns/types.h
+++ bind-9.10.3-P2/lib/dns/include/dns/types.h
@@ -140,6 +140,7 @@
typedef ISC_LIST(dns_zone_t) dns_zonelist_t;
typedef struct dns_zonemgr dns_zonemgr_t;
typedef struct dns_zt dns_zt_t;
@@ -632,10 +639,11 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/include/dns/types.h bind-9.10.1-P1-patche
/*
* If we are not using GSSAPI, define the types we use as opaque types here.
diff -rupN bind-9.10.1-P1-orig/lib/dns/log.c bind-9.10.1-P1-patched/lib/dns/log.c
--- bind-9.10.1-P1-orig/lib/dns/log.c 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/log.c 2015-04-27 11:33:20.621196475 +0200
@@ -85,6 +85,7 @@ LIBDNS_EXTERNAL_DATA isc_logmodule_t dns
Index: bind-9.10.3-P2/lib/dns/log.c
===================================================================
--- bind-9.10.3-P2.orig/lib/dns/log.c
+++ bind-9.10.3-P2/lib/dns/log.c
@@ -84,6 +84,7 @@
{ "dns/dnssec", 0 },
{ "dns/crypto", 0 },
{ "dns/packets", 0 },
@@ -643,10 +651,11 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/log.c bind-9.10.1-P1-patched/lib/dns/log.
{ NULL, 0 }
};
diff -rupN bind-9.10.1-P1-orig/lib/dns/Makefile.in bind-9.10.1-P1-patched/lib/dns/Makefile.in
--- bind-9.10.1-P1-orig/lib/dns/Makefile.in 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/dns/Makefile.in 2015-04-27 11:36:30.228342475 +0200
@@ -65,7 +65,7 @@ GEOIPLINKOBJS = geoip.@O@
Index: bind-9.10.3-P2/lib/dns/Makefile.in
===================================================================
--- bind-9.10.3-P2.orig/lib/dns/Makefile.in
+++ bind-9.10.3-P2/lib/dns/Makefile.in
@@ -65,7 +65,7 @@
DNSOBJS = acache.@O@ acl.@O@ adb.@O@ byaddr.@O@ \
cache.@O@ callbacks.@O@ clientinfo.@O@ compress.@O@ \
db.@O@ dbiterator.@O@ dbtable.@O@ diff.@O@ dispatch.@O@ \
@@ -655,7 +664,7 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/Makefile.in bind-9.10.1-P1-patched/lib/dn
iptable.@O@ journal.@O@ keydata.@O@ keytable.@O@ \
lib.@O@ log.@O@ lookup.@O@ \
master.@O@ masterdump.@O@ message.@O@ \
@@ -103,7 +103,7 @@ GEOIOLINKSRCS = geoip.c
@@ -103,7 +103,7 @@
DNSSRCS = acache.c acl.c adb.c byaddr.c \
cache.c callbacks.c clientinfo.c compress.c \
db.c dbiterator.c dbtable.c diff.c dispatch.c \
@@ -664,7 +673,7 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/Makefile.in bind-9.10.1-P1-patched/lib/dn
iptable.c journal.c keydata.c keytable.c lib.c log.c \
lookup.c master.c masterdump.c message.c \
name.c ncache.c nsec.c nsec3.c order.c peer.c portlist.c \
@@ -138,6 +138,11 @@ version.@O@: version.c
@@ -138,6 +138,11 @@
-DLIBAGE=${LIBAGE} \
-c ${srcdir}/version.c
@@ -676,10 +685,11 @@ diff -rupN bind-9.10.1-P1-orig/lib/dns/Makefile.in bind-9.10.1-P1-patched/lib/dn
libdns.@SA@: ${OBJS}
${AR} ${ARFLAGS} $@ ${OBJS}
${RANLIB} $@
diff -rupN bind-9.10.1-P1-orig/lib/isccfg/namedconf.c bind-9.10.1-P1-patched/lib/isccfg/namedconf.c
--- bind-9.10.1-P1-orig/lib/isccfg/namedconf.c 2014-11-21 00:56:37.000000000 +0100
+++ bind-9.10.1-P1-patched/lib/isccfg/namedconf.c 2015-04-27 11:33:20.621196475 +0200
@@ -660,6 +660,40 @@ static cfg_type_t cfg_type_transferforma
Index: bind-9.10.3-P2/lib/isccfg/namedconf.c
===================================================================
--- bind-9.10.3-P2.orig/lib/isccfg/namedconf.c
+++ bind-9.10.3-P2/lib/isccfg/namedconf.c
@@ -661,6 +661,40 @@
&transferformat_enums
};
@@ -720,7 +730,7 @@ diff -rupN bind-9.10.1-P1-orig/lib/isccfg/namedconf.c bind-9.10.1-P1-patched/lib
/*%
* The special keyword "none", as used in the pid-file option.
*/
@@ -906,6 +940,7 @@ namedconf_or_view_clauses[] = {
@@ -962,6 +996,7 @@
{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI },
{ "dlz", &cfg_type_dlz, CFG_CLAUSEFLAG_MULTI },
@@ -728,7 +738,7 @@ diff -rupN bind-9.10.1-P1-orig/lib/isccfg/namedconf.c bind-9.10.1-P1-patched/lib
{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
{ "trusted-keys", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI },
{ "managed-keys", &cfg_type_managedkeys, CFG_CLAUSEFLAG_MULTI },
@@ -2131,6 +2166,7 @@ static cfg_type_t cfg_type_dialuptype =
@@ -2188,6 +2223,7 @@
&cfg_rep_string, dialup_enums
};
@@ -736,7 +746,7 @@ diff -rupN bind-9.10.1-P1-orig/lib/isccfg/namedconf.c bind-9.10.1-P1-patched/lib
static const char *notify_enums[] = { "explicit", "master-only", NULL };
static isc_result_t
parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
@@ -3199,3 +3235,4 @@ static cfg_type_t cfg_type_maxttl = {
@@ -3256,3 +3292,4 @@
"maxttl_no_default", parse_maxttl, cfg_print_ustring, cfg_doc_terminal,
&cfg_rep_string, maxttl_enums
};