diff options
Diffstat (limited to 'dns/bind913')
| -rw-r--r-- | dns/bind913/Makefile | 2 | ||||
| -rw-r--r-- | dns/bind913/files/patch-CVE-2018-5738 | 112 |
2 files changed, 113 insertions, 1 deletions
diff --git a/dns/bind913/Makefile b/dns/bind913/Makefile index e64edb4376af..cd09af2f48f1 100644 --- a/dns/bind913/Makefile +++ b/dns/bind913/Makefile @@ -8,7 +8,7 @@ PORTVERSION= ${ISCVERSION:S/-P/P/:S/b/.b/:S/a/.a/:S/rc/.rc/} PORTREVISION= 0 .else # dns/bind913 here -PORTREVISION= 0 +PORTREVISION= 1 .endif CATEGORIES= dns net ipv6 MASTER_SITES= ISC/bind9/${ISCVERSION} diff --git a/dns/bind913/files/patch-CVE-2018-5738 b/dns/bind913/files/patch-CVE-2018-5738 new file mode 100644 index 000000000000..7cbc1b47e2e3 --- /dev/null +++ b/dns/bind913/files/patch-CVE-2018-5738 @@ -0,0 +1,112 @@ +commit 03ecba2cdc8d9a6cb6bdf863ffa1e230cb4ff223 +Author: Evan Hunt <each@isc.org> +Date: 2018-06-04 15:57:58 -0700 + + allow-recursion could incorrectly inherit from the default allow-query + +--- CHANGES.orig 2018-05-22 23:42:35 UTC ++++ CHANGES +@@ -1,3 +1,10 @@ ++4960. [security] When recursion is enabled, but the "allow-recursion" ++ and "allow-query-cache" ACLs are not specified, ++ they should be limited to local networks, ++ but were inadvertently set to match the default ++ "allow-query", thus allowing remote queries. ++ (CVE-2018-5738) [GL #309] ++ + --- 9.13.0 released --- + + 4950. [bug] ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238] +--- bin/named/server.c.orig 2018-05-22 23:42:35 UTC ++++ bin/named/server.c +@@ -3723,10 +3723,6 @@ configure_view(dns_view_t *view, dns_vie + CHECKM(named_config_getport(config, &port), "port"); + dns_view_setdstport(view, port); + +- CHECK(configure_view_acl(vconfig, config, named_g_config, +- "allow-query", NULL, actx, +- named_g_mctx, &view->queryacl)); +- + /* + * Make the list of response policy zone names for a view that + * is used for real lookups and so cares about hints. +@@ -4695,21 +4691,35 @@ configure_view(dns_view_t *view, dns_vie + "allow-query-cache-on", NULL, actx, + named_g_mctx, &view->cacheonacl)); + /* +- * Set "allow-query-cache", "allow-recursion", and +- * "allow-recursion-on" acls if configured in named.conf. +- * (Ignore the global defaults for now, because these ACLs +- * can inherit from each other when only some of them set at +- * the options/view level.) ++ * Set the "allow-query", "allow-query-cache", "allow-recursion", ++ * and "allow-recursion-on" ACLs if configured in named.conf, but ++ * NOT from the global defaults. This is done by leaving the third ++ * argument to configure_view_acl() NULL. ++ * ++ * We ignore the global defaults here because these ACLs ++ * can inherit from each other. If any are still unset after ++ * applying the inheritance rules, we'll look up the defaults at ++ * that time. + */ +- CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache", +- NULL, actx, named_g_mctx, &view->cacheacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query", NULL, actx, ++ named_g_mctx, &view->queryacl)); ++ ++ /* named.conf only */ ++ CHECK(configure_view_acl(vconfig, config, NULL, ++ "allow-query-cache", NULL, actx, ++ named_g_mctx, &view->cacheacl)); + + if (strcmp(view->name, "_bind") != 0 && + view->rdclass != dns_rdataclass_chaos) + { ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion", NULL, actx, + named_g_mctx, &view->recursionacl)); ++ /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-recursion-on", NULL, actx, + named_g_mctx, &view->recursiononacl)); +@@ -4747,18 +4757,21 @@ configure_view(dns_view_t *view, dns_vie + * the global config. + */ + if (view->recursionacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-recursion", NULL, + actx, named_g_mctx, + &view->recursionacl)); + } + if (view->recursiononacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-recursion-on", NULL, + actx, named_g_mctx, + &view->recursiononacl)); + } + if (view->cacheacl == NULL) { ++ /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-query-cache", NULL, + actx, named_g_mctx, +@@ -4772,6 +4785,14 @@ configure_view(dns_view_t *view, dns_vie + CHECK(dns_acl_none(mctx, &view->cacheacl)); + } + ++ if (view->queryacl == NULL) { ++ /* global default only */ ++ CHECK(configure_view_acl(NULL, NULL, named_g_config, ++ "allow-query", NULL, ++ actx, named_g_mctx, ++ &view->queryacl)); ++ } ++ + /* + * Ignore case when compressing responses to the specified + * clients. This causes case not always to be preserved, |