4510. [security] Named mishandled some responses where covering RRSIG

                        records are returned without the requested data
                        resulting in a assertion failure. (CVE-2016-9147)
                        [RT #43548]

diff --git a/CHANGES b/CHANGES
index 92660e3e96d91e8fe0d0df8d8847e60680078794..51b951379858ab9bbcc94d55259fab2bc65ce89d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -108,7 +108,10 @@
 
 4511.  [bug]           win32: mdig.exe-BNFT was missing Configure. [RT #43554]
 
-4510.  [placeholder]
+4510.  [security]      Named mishandled some responses where covering RRSIG
+                       records are returned without the requested data
+                       resulting in a assertion failure. (CVE-2016-9147)
+                       [RT #43548]
 
 4509.  [test]          Make the rrl system test more reliable on slower
                        machines by using mdig instead of dig. [RT #43280]

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 83da471833c5222b4bbc65ba26e2bbdca4f4745c..699c805d0f4cfb6dfe6b368edc02b31b68dd416d 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6984,15 +6984,19 @@ answer_response(fetchctx_t *fctx) {
                                                 * a CNAME or DNAME).
                                                 */
                                                INSIST(!external);
-                                               if ((rdataset->type !=
-                                                    dns_rdatatype_cname) ||
-                                                   !found_dname ||
-                                                   (aflag ==
-                                                    DNS_RDATASETATTR_ANSWER))
+                                               /*
+                                                * Don't use found_cname here
+                                                * as we have just set it
+                                                * above.
+                                                */
+                                               if (cname == NULL &&
+                                                   !found_dname &&
+                                                   aflag ==
+                                                    DNS_RDATASETATTR_ANSWER)
                                                {
                                                        have_answer = ISC_TRUE;
-                                                       if (rdataset->type ==
-                                                           dns_rdatatype_cname)
+                                                       if (found_cname &&
+                                                           cname == NULL)
                                                                cname = name;
                                                        name->attributes |=
                                                            DNS_NAMEATTR_ANSWER;