[Pkg-dns-devel] Bug#889285: bind9: CVE-2017-3139 affects debian too: assertion failure in validator.c:1858

Thu Feb 8 04:21:39 UTC 2018

On Sat, Feb 03, 2018 at 05:17:01PM +0100, Salvatore Bonaccorso wrote:
> 
> The bug was about CVE-2017-3137, it's never a good idea to mix up
> things ;-).

This is true.  However, it appears that Ondrej Zary's comment to #860225
on 2017-09-02 is in fact related to CVE-2017-3139.  Since one of the
bind9 maintainers was the one to raise the issue of CVE-2017-3139 in
that same bug, I don't see a related follow-up report from a user to be
problematic.

> Anyway thanks that you took action and filled a new bug
> for this issue you are experiencing.
> 
> JTR, since Red Hat does not provide much details on the CVE-2017-3139
> we cannot say Debian is affected as well by this very same CVE. Since
> it's not clear, what CVE-2017-3139 is in detail, I have removed the
> CVE in the subject of this bug.
> 
It is true that there is information provided by RedHat regarding the
details of the vulnerability.  The RHSA mentioned in #860225 is also
linked from this RedHat BZ:

https://bugzilla.redhat.com/show_bug.cgi?id=1447743

However, there are no useful details there either.  I did some digging
and located the bind9 source RPM references in RHSA-2017:1202 and its
immediate predecessor.  By comparing the packages, I was able to
identify the specific patch that was associated with that RHSA.  I have
attached the patch to this email.  The name of the patch refers to
another RedHat BZ entry:

https://bugzilla.redhat.com/show_bug.cgi?id=1447407

That one is not accessible to the public, so we have no way of knowing
the details there.  Additionally, the related upstream RT tickets are
also not public.

Note that the attached patch appears to be based on commit
07dbb507d2913fc35c7edbe3692a976e3248a911 from upstream's git repository:

https://source.isc.org/git/bind9.git

The upstream changes appear to include a hunk in resolver.c which does
not appear in the RedHat patch.  That chunk would also not apply to the
wheezy version of bind9.

> What seem clear is that apparently a fix in Debian wheezy's bind9
> version causes the regression you notices. Thus I suggest the LTS team
> to try to find the defective patch introducing the issue and then
> issue just a regression update (without referencing CVE-2017-3139. If
> its on the other hand clear that Debian wheezy used the very same
> patch for a previous issue, and CVE-2017-3139 applies as well for
> Debian wheezy, then obviously it's fine to use the CVE).
> 
I examined the changes made from 9.8.4.dfsg.P1-6+nmu2+deb7u15 to
9.8.4.dfsg.P1-6+nmu2+deb7u16, which included fixes for CVE-2017-3136,
CVE-2017-3137, and CVE-2017-3138.  After examining the changes and
comparing them to the related upstream commits, I am convinced that the
fix for CVE-2017-3137 in 9.8.4.dfsg.P1-6+nmu2+deb7u16 is correct and
complete.  I would consider my examination thorough, but not exhaustive
owing to the large volume of change and some departures that are clearly
a result of the upsteam changes being backported to the bind9 in wheezy.
I am further convinced that the problem reported by Ondrej Zary in
#860225 and by Vladislav Kurz are both identical occurrences of
CVE-2017-3139.

In order to confirm the latter hypothesis, I built the current wheezy
version of bind9 and ran the dnssec test.  The test passed.  I then
stripped the changes to validator.c from the attached patch and applied
the remainder to the current wheezy version of bind9, built, and ran the
dnssec test again.  This time the test failed.  This seems to indicate
that the version of bind9 in wheezy is vulnerable to CVE-2017-3139.  I
then applied the remaining validator.c changes, rebuilt, and ran the
dnssec test again.  This time the test passed.

Based on these findings, I conclude that wheezy bind9 is vulnerable to
CVE-2017-3139.  I propose to do the following:

- Mark CVE-2017-3139 as affecting wheezy in the security tracker
- Prepare and upload a version 9.8.4.dfsg.P1-6+nmu2+deb7u20 upload that
  incorporates the CVE-2017-3139 patch from RedHat (and which closes
  this bug, #889285)
- Release a DLA per the normal procedure

I am now in the process of preparing the package for upload, but I will
wait a couple of days to allow for any objections and/or suggestions.

Regards,

-Roberto

-- 
Roberto C. Sánchez
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bind99-rh1447407.patch
Type: text/x-diff
Size: 5951 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-dns-devel/attachments/20180207/974c1e89/attachment.patch>