Patrick Williams | d8c66bc | 2016-06-20 12:57:21 -0500 | [diff] [blame] | 1 | From 70037e040e587329cec82123e12b9f4f7c945f67 Mon Sep 17 00:00:00 2001 |
| 2 | From: Mark Andrews <marka@isc.org> |
| 3 | Date: Thu, 18 Feb 2016 12:11:27 +1100 |
| 4 | Subject: [PATCH] 4318. [security] Malformed control messages can |
| 5 | trigger assertions in named and rndc. (CVE-2016-1285) |
| 6 | [RT #41666] |
| 7 | |
| 8 | (cherry picked from commit a2b15b3305acd52179e6f3dc7d073b07fbc40b8e) |
| 9 | |
| 10 | CVE: CVE-2016-1285 |
| 11 | Upstream-Status: Backport |
| 12 | [Removed doc/arm/notes.xml changes from upstream patch] |
| 13 | |
| 14 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> |
| 15 | --- |
| 16 | CHANGES | 3 +++ |
| 17 | bin/named/control.c | 2 +- |
| 18 | bin/named/controlconf.c | 2 +- |
| 19 | bin/rndc/rndc.c | 8 ++++---- |
| 20 | doc/arm/notes.xml | 11 +++++++++++ |
| 21 | lib/isccc/cc.c | 14 +++++++------- |
| 22 | 6 files changed, 27 insertions(+), 13 deletions(-) |
| 23 | |
| 24 | diff --git a/CHANGES b/CHANGES |
| 25 | index b9bd9ef..2c727d5 100644 |
| 26 | --- a/CHANGES |
| 27 | +++ b/CHANGES |
| 28 | @@ -1,3 +1,6 @@ |
| 29 | +4318. [security] Malformed control messages can trigger assertions |
| 30 | + in named and rndc. (CVE-2016-1285) [RT #41666] |
| 31 | + |
| 32 | --- 9.10.3-P3 released --- |
| 33 | |
| 34 | 4288. [bug] Fixed a regression in resolver.c:possibly_mark() |
| 35 | diff --git a/bin/named/control.c b/bin/named/control.c |
| 36 | index 8554335..81340ca 100644 |
| 37 | --- a/bin/named/control.c |
| 38 | +++ b/bin/named/control.c |
| 39 | @@ -69,7 +69,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { |
| 40 | #endif |
| 41 | |
| 42 | data = isccc_alist_lookup(message, "_data"); |
| 43 | - if (data == NULL) { |
| 44 | + if (!isccc_alist_alistp(data)) { |
| 45 | /* |
| 46 | * No data section. |
| 47 | */ |
| 48 | diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c |
| 49 | index 765afdd..a39ab8b 100644 |
| 50 | --- a/bin/named/controlconf.c |
| 51 | +++ b/bin/named/controlconf.c |
| 52 | @@ -402,7 +402,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) { |
| 53 | * Limit exposure to replay attacks. |
| 54 | */ |
| 55 | _ctrl = isccc_alist_lookup(request, "_ctrl"); |
| 56 | - if (_ctrl == NULL) { |
| 57 | + if (!isccc_alist_alistp(_ctrl)) { |
| 58 | log_invalid(&conn->ccmsg, ISC_R_FAILURE); |
| 59 | goto cleanup_request; |
| 60 | } |
| 61 | diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c |
| 62 | index cb17050..b6e05c8 100644 |
| 63 | --- a/bin/rndc/rndc.c |
| 64 | +++ b/bin/rndc/rndc.c |
| 65 | @@ -255,8 +255,8 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) { |
| 66 | isccc_cc_fromwire(&source, &response, algorithm, &secret)); |
| 67 | |
| 68 | data = isccc_alist_lookup(response, "_data"); |
| 69 | - if (data == NULL) |
| 70 | - fatal("no data section in response"); |
| 71 | + if (!isccc_alist_alistp(data)) |
| 72 | + fatal("bad or missing data section in response"); |
| 73 | result = isccc_cc_lookupstring(data, "err", &errormsg); |
| 74 | if (result == ISC_R_SUCCESS) { |
| 75 | failed = ISC_TRUE; |
| 76 | @@ -321,8 +321,8 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) { |
| 77 | isccc_cc_fromwire(&source, &response, algorithm, &secret)); |
| 78 | |
| 79 | _ctrl = isccc_alist_lookup(response, "_ctrl"); |
| 80 | - if (_ctrl == NULL) |
| 81 | - fatal("_ctrl section missing"); |
| 82 | + if (!isccc_alist_alistp(_ctrl)) |
| 83 | + fatal("bad or missing ctrl section in response"); |
| 84 | nonce = 0; |
| 85 | if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS) |
| 86 | nonce = 0; |
| 87 | diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c |
| 88 | index 47a3b74..2bb961e 100644 |
| 89 | --- a/lib/isccc/cc.c |
| 90 | +++ b/lib/isccc/cc.c |
| 91 | @@ -403,13 +403,13 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length, |
| 92 | * Extract digest. |
| 93 | */ |
| 94 | _auth = isccc_alist_lookup(alist, "_auth"); |
| 95 | - if (_auth == NULL) |
| 96 | + if (!isccc_alist_alistp(_auth)) |
| 97 | return (ISC_R_FAILURE); |
| 98 | if (algorithm == ISCCC_ALG_HMACMD5) |
| 99 | hmac = isccc_alist_lookup(_auth, "hmd5"); |
| 100 | else |
| 101 | hmac = isccc_alist_lookup(_auth, "hsha"); |
| 102 | - if (hmac == NULL) |
| 103 | + if (!isccc_sexpr_binaryp(hmac)) |
| 104 | return (ISC_R_FAILURE); |
| 105 | /* |
| 106 | * Compute digest. |
| 107 | @@ -728,7 +728,7 @@ isccc_cc_createack(isccc_sexpr_t *message, isc_boolean_t ok, |
| 108 | REQUIRE(ackp != NULL && *ackp == NULL); |
| 109 | |
| 110 | _ctrl = isccc_alist_lookup(message, "_ctrl"); |
| 111 | - if (_ctrl == NULL || |
| 112 | + if (!isccc_alist_alistp(_ctrl) || |
| 113 | isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS || |
| 114 | isccc_cc_lookupuint32(_ctrl, "_tim", &t) != ISC_R_SUCCESS) |
| 115 | return (ISC_R_FAILURE); |
| 116 | @@ -773,7 +773,7 @@ isccc_cc_isack(isccc_sexpr_t *message) |
| 117 | isccc_sexpr_t *_ctrl; |
| 118 | |
| 119 | _ctrl = isccc_alist_lookup(message, "_ctrl"); |
| 120 | - if (_ctrl == NULL) |
| 121 | + if (!isccc_alist_alistp(_ctrl)) |
| 122 | return (ISC_FALSE); |
| 123 | if (isccc_cc_lookupstring(_ctrl, "_ack", NULL) == ISC_R_SUCCESS) |
| 124 | return (ISC_TRUE); |
| 125 | @@ -786,7 +786,7 @@ isccc_cc_isreply(isccc_sexpr_t *message) |
| 126 | isccc_sexpr_t *_ctrl; |
| 127 | |
| 128 | _ctrl = isccc_alist_lookup(message, "_ctrl"); |
| 129 | - if (_ctrl == NULL) |
| 130 | + if (!isccc_alist_alistp(_ctrl)) |
| 131 | return (ISC_FALSE); |
| 132 | if (isccc_cc_lookupstring(_ctrl, "_rpl", NULL) == ISC_R_SUCCESS) |
| 133 | return (ISC_TRUE); |
| 134 | @@ -806,7 +806,7 @@ isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now, |
| 135 | |
| 136 | _ctrl = isccc_alist_lookup(message, "_ctrl"); |
| 137 | _data = isccc_alist_lookup(message, "_data"); |
| 138 | - if (_ctrl == NULL || _data == NULL || |
| 139 | + if (!isccc_alist_alistp(_ctrl) || !isccc_alist_alistp(_data) || |
| 140 | isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS || |
| 141 | isccc_cc_lookupstring(_data, "type", &type) != ISC_R_SUCCESS) |
| 142 | return (ISC_R_FAILURE); |
| 143 | @@ -995,7 +995,7 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message, |
| 144 | isccc_sexpr_t *_ctrl; |
| 145 | |
| 146 | _ctrl = isccc_alist_lookup(message, "_ctrl"); |
| 147 | - if (_ctrl == NULL || |
| 148 | + if (!isccc_alist_alistp(_ctrl) || |
| 149 | isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS || |
| 150 | isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS) |
| 151 | return (ISC_R_FAILURE); |
| 152 | -- |
| 153 | 1.9.1 |
| 154 | |