From owner-svn-ports-all@freebsd.org Thu Jan 12 07:27:15 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 931A3CACD89; Thu, 12 Jan 2017 07:27:15 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6D3C618A2; Thu, 12 Jan 2017 07:27:15 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v0C7REsE023496; Thu, 12 Jan 2017 07:27:14 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v0C7REpE023494; Thu, 12 Jan 2017 07:27:14 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201701120727.v0C7REpE023494@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Thu, 12 Jan 2017 07:27:14 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r431223 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Jan 2017 07:27:15 -0000 Author: delphij Date: Thu Jan 12 07:27:14 2017 New Revision: 431223 URL: https://svnweb.freebsd.org/changeset/ports/431223 Log: Document BIND multiple vulnerabilities. Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Jan 12 07:12:47 2017 (r431222) +++ head/security/vuxml/vuln.xml Thu Jan 12 07:27:14 2017 (r431223) @@ -58,6 +58,94 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + BIND -- multiple vulnerabilities + + + bind99 + 9.9.9P5 + + + bind910 + 9.10.4P5 + + + bind911 + 9.11.0P2 + + + bind9-devel + 0 + + + FreeBSD + 9.310.0 + + + + +

ISC reports:

+
A malformed query response received by a recursive + server in response to a query of RTYPE ANY could + trigger an assertion failure while named is attempting + to add the RRs in the query response to the cache.
+

+
Depending on the type of query and the EDNS options + in the query they receive, DNSSEC-enabled authoritative + servers are expected to include RRSIG and other RRsets + in their responses to recursive servers. + DNSSEC-validating servers will also make specific queries + for DS and other RRsets. + Whether DNSSEC-validating or not, an error in processing + malformed query responses that contain DNSSEC-related + RRsets that are inconsistent with other RRsets in the + same query response can trigger an assertion failure. + Although the combination of properties which triggers + the assertion should not occur in normal traffic, it + is potentially possible for the assertion to be triggered + deliberately by an attacker sending a specially-constructed + answer.
+

+
An unusually-formed answer containing a DS resource + record could trigger an assertion failure. While the + combination of properties which triggers the assertion + should not occur in normal traffic, it is potentially + possible for the assertion to be triggered deliberately + by an attacker sending a specially-constructed answer + having the required properties.
+

+
An error in handling certain queries can cause an + assertion failure when a server is using the + nxdomain-redirect feature to cover a zone for which + it is also providing authoritative service. + A vulnerable server could be intentionally stopped + by an attacker if it was using a configuration that + met the criteria for the vulnerability and if the + attacker could cause it to accept a query that + possessed the required attributes.
+

+ + + + CVE-2016-9131 + CVE-2016-9147 + CVE-2016-9444 + CVE-2016-9778 + https://kb.isc.org/article/AA-01439/0 + https://kb.isc.org/article/AA-01440/0 + https://kb.isc.org/article/AA-01441/0 + https://kb.isc.org/article/AA-01442/0 + + + 2017-01-11 + 2017-01-12 + + + FreeBSD -- OpenSSH multiple vulnerabilities