Fix resolver assertion failure due to improper DNAME handling (CVE-2016-1286) (#41753)

(cherry picked from commit 5995fec51cc8bb7e53804e4936e60aa1537f3673)
(cherry picked from commit 456e1eadd2a3a2fb9617e60d4db90ef4ba7c6ba3)

diff --git a/CHANGES b/CHANGES
index 3fbfd95756bd47e8afa1b306662e638c8476dce8..b2bd38aab91f9da1686acb5909a9e830dc6bcf24 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,9 @@
        --- 9.9.8-P4 released ---
 
+4319.  [security]      Fix resolver assertion failure due to improper
+                       DNAME handling when parsing fetch reply messages.
+                       (CVE-2016-1286) [RT #41753]
+
 4318.  [security]      Malformed control messages can trigger assertions
                        in named and rndc. (CVE-2016-1285) [RT #41666]
 

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 74d78336560177a1b15dfdc7a32b9097893b2283..ab10e90a21964eba033e08499098ef0c9a862ce8 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -87,6 +87,13 @@
          #41666]
        </para>
       </listitem>
+      <listitem>
+       <para>
+         The resolver could abort with an assertion failure due to
+         improper DNAME handling when parsing fetch reply
+         messages. This flaw is disclosed in CVE-2016-1286. [RT #41753]
+       </para>
+      </listitem>
     </itemizedlist>
   </sect2>
   <sect2 id="relnotes_features">

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index a6cbc78aea58ffc5a5b88a340460822f0885e8be..cd009f865aadeb6746af94f41c88c9e72b583580 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6687,21 +6687,26 @@ answer_response(fetchctx_t *fctx) {
                                isc_boolean_t found_dname = ISC_FALSE;
                                dns_name_t *dname_name;
 
+                               /*
+                                * Only pass DNAME or RRSIG(DNAME).
+                                */
+                               if (rdataset->type != dns_rdatatype_dname &&
+                                   (rdataset->type != dns_rdatatype_rrsig ||
+                                    rdataset->covers != dns_rdatatype_dname))
+                                       continue;
+
+                               /*
+                                * If we're not chaining, then the DNAME and
+                                * its signature should not be external.
+                                */
+                               if (!chaining && external) {
+                                       log_formerr(fctx, "external DNAME");
+                                       return (DNS_R_FORMERR);
+                               }
+
                                found = ISC_FALSE;
                                aflag = 0;
                                if (rdataset->type == dns_rdatatype_dname) {
-                                       /*
-                                        * We're looking for something else,
-                                        * but we found a DNAME.
-                                        *
-                                        * If we're not chaining, then the
-                                        * DNAME should not be external.
-                                        */
-                                       if (!chaining && external) {
-                                               log_formerr(fctx,
-                                                           "external DNAME");
-                                               return (DNS_R_FORMERR);
-                                       }
                                        found = ISC_TRUE;
                                        want_chaining = ISC_TRUE;
                                        POST(want_chaining);
@@ -6730,9 +6735,7 @@ answer_response(fetchctx_t *fctx) {
                                                        &fctx->domain)) {
                                                return (DNS_R_SERVFAIL);
                                        }
-                               } else if (rdataset->type == dns_rdatatype_rrsig
-                                          && rdataset->covers ==
-                                          dns_rdatatype_dname) {
+                               } else {
                                        /*
                                         * We've found a signature that
                                         * covers the DNAME.