4508. [security] Named incorrectly tried to cache TKEY records which

                            could trigger a assertion failure when there was
                            a class mismatch. (CVE-2016-9131) [RT #43522]

(cherry picked from commit 2c1c4b99a127a0f34e10fe27324d552ccbc54e04)

diff --git a/CHANGES b/CHANGES
index b993dabdffe777c5660dc63c89f69018b8f54a10..1e4f74b87e444efa889ee8e8c7ea1a3bf4e16ae1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -82,6 +82,10 @@
 4509.  [test]          Make the rrl system test more reliable on slower
                        machines by using mdig instead of dig. [RT #43280]
 
+4508.  [security]      Named incorrectly tried to cache TKEY records which
+                       could trigger a assertion failure when there was
+                       a class mismatch. (CVE-2016-9131) [RT #43522]
+
 4507.  [bug]           Named could incorrectly log 'allows updates by IP
                        address, which is insecure' [RT #43432]
 

diff --git a/README b/README
index 25a9b95c3f0b8bf9d6ca26f2604ee58e0dda6b0e..a2f5df802077f30ba0bb4889697781c2842138a1 100644 (file)
--- a/README
+++ b/README
@@ -51,6 +51,11 @@ BIND 9
        For up-to-date release notes and errata, see
        http://www.isc.org/software/bind9/releasenotes
 
+BIND 9.10.5
+       
+       BIND 9.10.5 is a maintenance release and addresses the security
+       flaws disclosed in CVE-2016-6170, CVE-2016-8864 and CVE-2016-9131.
+
 BIND 9.10.4
 
        BIND 9.10.4 is a maintenance release and addresses bugs

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index e3962f1943a2155623f6a607dcfad99df09c6cbe..e4431eda92a647b7beeab81c82ed37e36553552b 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -98,6 +98,13 @@
          prefix.
        </para>
       </listitem>
+      <listitem>
+       <para>
+         Named incorrectly tried to cache TKEY records which could
+         trigger a assertion failure when there was a class mismatch.
+         This flaw is disclosed in CVE-2016-9131.  [RT #43522]
+       </para>
+      </listitem>
     </itemizedlist>
   </section>
 

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index f04aa75ac3ad516936c0735ff157b2e4866a83ec..a013f19eeaa7ef735aefbc2a4b5036dbbaf5ead5 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6809,6 +6809,19 @@ answer_response(fetchctx_t *fctx) {
                                        log_formerr(fctx, "NSEC3 in answer");
                                        return (DNS_R_FORMERR);
                                }
+                               if (rdataset->type == dns_rdatatype_tkey) {
+                                       /*
+                                        * TKEY is not a valid record in a
+                                        * response to any query we can make.
+                                        */
+                                       log_formerr(fctx, "TKEY in answer");
+                                       return (DNS_R_FORMERR);
+                               }
+                               if (rdataset->rdclass != fctx->res->rdclass) {
+                                       log_formerr(fctx, "Mismatched class "
+                                                   "in answer");
+                                       return (DNS_R_FORMERR);
+                               }
 
                                /*
                                 * Apply filters, if given, on answers to reject
@@ -6995,6 +7008,12 @@ answer_response(fetchctx_t *fctx) {
                             rdataset != NULL;
                             rdataset = ISC_LIST_NEXT(rdataset, link))
                        {
+                               if (rdataset->rdclass != fctx->res->rdclass) {
+                                       log_formerr(fctx, "Mismatched class "
+                                                   "in answer");
+                                       return (DNS_R_FORMERR);
+                               }
+
                                /*
                                 * Only pass DNAME or RRSIG(DNAME).
                                 */