diff options
Diffstat (limited to 'dns/bind910/files/patch-CVE-2018-5738')
| -rw-r--r-- | dns/bind910/files/patch-CVE-2018-5738 | 127 |
1 files changed, 127 insertions, 0 deletions
diff --git a/dns/bind910/files/patch-CVE-2018-5738 b/dns/bind910/files/patch-CVE-2018-5738 new file mode 100644 index 000000000000..c040f6b51679 --- /dev/null +++ b/dns/bind910/files/patch-CVE-2018-5738 @@ -0,0 +1,127 @@ +commit 97600626c711585e7bb26cbc67711d072e87a62a +Author: Evan Hunt <each@isc.org> +Date: 2018-06-04 21:57:49 -0700 + + allow-recursion could incorrectly inherit from the default allow-query + +--- CHANGES.orig 2018-03-08 20:55:52 UTC ++++ CHANGES +@@ -1,3 +1,10 @@ ++4960. [security] When recursion is enabled, but the "allow-recursion" ++ and "allow-query-cache" ACLs are not specified, ++ they should be limited to local networks, ++ but were inadvertently set to match the default ++ "allow-query", thus allowing remote queries. ++ (CVE-2018-5738) [GL #309] ++ + --- 9.10.7 released --- + --- 9.10.7rc2 released --- + +--- bin/named/server.c.orig 2018-03-08 20:55:52 UTC ++++ bin/named/server.c +@@ -2565,10 +2565,6 @@ configure_view(dns_view_t *view, dns_vie + dns_acache_setcachesize(view->acache, max_acache_size); + } + +- CHECK(configure_view_acl(vconfig, config, ns_g_config, +- "allow-query", NULL, actx, +- ns_g_mctx, &view->queryacl)); +- + /* + * Make the list of response policy zone names for a view that + * is used for real lookups and so cares about hints. +@@ -3399,9 +3395,6 @@ configure_view(dns_view_t *view, dns_vie + INSIST(result == ISC_R_SUCCESS); + view->trust_anchor_telemetry = cfg_obj_asboolean(obj); + +- CHECK(configure_view_acl(vconfig, config, ns_g_config, +- "allow-query-cache-on", NULL, actx, +- ns_g_mctx, &view->cacheonacl)); + /* + * Set sources where additional data and CNAME/DNAME + * targets for authoritative answers may be found. +@@ -3428,22 +3421,40 @@ configure_view(dns_view_t *view, dns_vie + view->additionalfromcache = ISC_TRUE; + } + ++ CHECK(configure_view_acl(vconfig, config, ns_g_config, ++ "allow-query-cache-on", NULL, actx, ++ ns_g_mctx, &view->cacheonacl)); ++ + /* +- * Set "allow-query-cache", "allow-recursion", and +- * "allow-recursion-on" acls if configured in named.conf. +- * (Ignore the global defaults for now, because these ACLs +- * can inherit from each other when only some of them set at +- * the options/view level.) ++ * Set the "allow-query", "allow-query-cache", "allow-recursion", ++ * and "allow-recursion-on" ACLs if configured in named.conf, but ++ * NOT from the global defaults. This is done by leaving the third ++ * argument to configure_view_acl() NULL. ++ * ++ * We ignore the global defaults here because these ACLs ++ * can inherit from each other. If any are still unset after ++ * applying the inheritance rules, we'll look up the defaults at ++ * that time. + */ +- CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache", +- NULL, actx, ns_g_mctx, &view->cacheacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query", NULL, actx, ++ ns_g_mctx, &view->queryacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query-cache", NULL, actx, ++ ns_g_mctx, &view->cacheacl)); + + if (strcmp(view->name, "_bind") != 0 && + view->rdclass != dns_rdataclass_chaos) + { ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion", NULL, actx, + ns_g_mctx, &view->recursionacl)); ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion-on", NULL, actx, + ns_g_mctx, &view->recursiononacl)); +@@ -3481,18 +3492,21 @@ configure_view(dns_view_t *view, dns_vie + * the global config. + */ + if (view->recursionacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, ns_g_config, + "allow-recursion", NULL, + actx, ns_g_mctx, + &view->recursionacl)); + } + if (view->recursiononacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, ns_g_config, + "allow-recursion-on", NULL, + actx, ns_g_mctx, + &view->recursiononacl)); + } + if (view->cacheacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, ns_g_config, + "allow-query-cache", NULL, + actx, ns_g_mctx, +@@ -3506,6 +3520,14 @@ configure_view(dns_view_t *view, dns_vie + CHECK(dns_acl_none(mctx, &view->cacheacl)); + } + ++ if (view->queryacl == NULL) { ++ /* global default only */ ++ CHECK(configure_view_acl(NULL, NULL, ns_g_config, ++ "allow-query", NULL, ++ actx, ns_g_mctx, ++ &view->queryacl)); ++ } ++ + /* + * Ignore case when compressing responses to the specified + * clients. This causes case not always to be preserved, |