Hello community, here is the log from the commit of package adns.12885 for openSUSE:Leap:15.1:Update checked in at 2020-06-17 18:19:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.1:Update/adns.12885 (Old) and /work/SRC/openSUSE:Leap:15.1:Update/.adns.12885.new.3606 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "adns.12885" Wed Jun 17 18:19:02 2020 rev:1 rq:814099 version:1.5.1 Changes: -------- New Changes file: --- /dev/null 2020-05-28 02:28:09.919761697 +0200 +++ /work/SRC/openSUSE:Leap:15.1:Update/.adns.12885.new.3606/adns.changes 2020-06-17 18:19:04.812706164 +0200 @@ -0,0 +1,170 @@ +------------------------------------------------------------------- +Mon Jun 8 12:04:21 UTC 2020 - Kristyna Streitova <[email protected]> + +- add the following patches to fix multiple vulnerabilities [bsc#1172265] + * adns-1.5.1-CVE-2017-9103.patch [CVE-2017-9103] + * adns-1.5.1-CVE-2017-9104.patch [CVE-2017-9104] + * adns-1.5.1-CVE-2017-9105.patch [CVE-2017-9105] + * adns-1.5.1-CVE-2017-9106.patch [CVE-2017-9106] + * adns-1.5.1-CVE-2017-9107.patch [CVE-2017-9107] + * adns-1.5.1-CVE-2017-9108.patch [CVE-2017-9108] + * adns-1.5.1-CVE-2017-9109.patch [CVE-2017-9109] + +------------------------------------------------------------------- +Sat Nov 4 20:26:32 UTC 2017 - [email protected] + +- Update to 1.5.1 + * Fix addr queries (including subqueries, ie including deferencing MX + lookups etc.) not to crash when one of the address queries returns + tempfail. Also, do not return a spurious pointer to the application + when one of the address queries returns a permanent error (although, + the application almost certainly won't use this pointer because the + associated count is zero). + * Portability fix for systems where socklen_t is bigger than int. + * Fix for malicious optimisation of memcpy in test suite, which + causes failure with gcc-4.1.9 -O3. + * Fix TCP async connect handling. The bug is hidden on Linux and on most + systems where the nameserver is on localhost. If it is not hidden, + adns's TCP support is broken unless adns_if_noautosys is used. + * adnsresfilter: Fix addrtextbuf buffer size. This is not actually a + problem in real compiled code but should be corrected. + * Properly include harness.h in adnstest.c in regress/. Suppresses + a couple of compiler warnings (implicit declaration of Texit, etc.) +- cleanup with spec-cleaner + +------------------------------------------------------------------- +Thu Mar 23 15:13:56 UTC 2017 - [email protected] + +- cleanup with spec-cleaner +- get rid of %{name} macro in the patch name +- restart patch numbering + +------------------------------------------------------------------- +Mon Mar 2 19:52:21 UTC 2015 - [email protected] + +- Remove obsolete patches + * adns-ocloexec.patch + * adns-1.4-ipv6.patch +- Add gpg signature +- Cleanup spec-file with spec-cleaner +- Remove already disabled %check section, tests require working + network setup +- Update to 1.5.0 + * This release provides full IPv6 support. Applications can + request AAAA records (containing IPv6 addresses) as well as, + or instead of, A records (containing IPv4 addresses). adns + 1.5 can speak to nameservers over IPv6. + * converting between addresses and address literals. These carry + less baggage than getaddrinfo and getnameinfo. + * bugfixes and other minor changes (see changelog for details) + +------------------------------------------------------------------- +Tue Jun 11 22:44:58 UTC 2013 - [email protected] + +- remove debug statement in the spec file, leftover from + previous change. + +------------------------------------------------------------------- +Mon Jun 10 19:35:24 UTC 2013 - [email protected] + +- Build with large file support in 32 bit archs, autoconf + stuff is fine, but C files included config.h after C library + headers, therefore no prototypes for *64 functions found. + +------------------------------------------------------------------- +Wed Mar 20 12:08:57 UTC 2013 - [email protected] + +- Added download url as source. + Please see http://en.opensuse.org/SourceUrls + +------------------------------------------------------------------- +Tue Dec 20 11:24:52 UTC 2011 - [email protected] + +- add autoconf as buildrequire to avoid implicit dependency + +------------------------------------------------------------------- +Tue Nov 22 15:09:47 UTC 2011 - [email protected] + +- Remove redundant/unwanted tags/section (cf. specfile guidelines) + +------------------------------------------------------------------- +Tue Nov 22 02:23:10 UTC 2011 - [email protected] + +- Use O_CLOEXEC in library code. +- Change the visibility patch to not use the error prone + version-script but rather GCC visibility + +------------------------------------------------------------------- +Fri Sep 16 19:06:22 UTC 2011 - [email protected] + +- Implement baselibs for package +- Remove redundant tags/sections from specfile + +------------------------------------------------------------------- +Sun Dec 19 23:07:43 UTC 2010 - [email protected] + +- Use 64bit file offsets + +------------------------------------------------------------------- +Fri Nov 5 20:35:16 UTC 2010 - [email protected] + +- export only public symbols + +------------------------------------------------------------------- +Fri Jan 16 23:00:59 CET 2009 - [email protected] + +- remove static libraries + +------------------------------------------------------------------- +Thu Sep 18 10:40:36 CEST 2008 - [email protected] + +- document CVE-2008-1447 / CVE-2008-4100 poisoning vulnerability + in README.SUSE [bnc#426515] + +------------------------------------------------------------------- +Wed Feb 20 17:08:29 CET 2008 - [email protected] + +- added patch to support IPv6 protocol [#350506] + +------------------------------------------------------------------- +Tue Aug 7 04:23:16 CEST 2007 - [email protected] + +- update to version 1.4 +- run ldconfig +- use library packaging policy +- run make check + +------------------------------------------------------------------- +Fri Sep 1 15:19:17 CEST 2006 - [email protected] + +- updated to adns-1.3, providing new support for SRV RRs + and unknown RRs as well as several portability fixes. +- adopted configure and destdir patches, removed obsolete + codecleanup and missing_symlink patches + +------------------------------------------------------------------- +Thu Apr 27 00:03:42 CEST 2006 - [email protected] + +- added adns-missing_symlink.diff: + add missing symlink "libadns.so" so you can dynamically + link against libadns. + +------------------------------------------------------------------- +Wed Jan 25 21:34:07 CET 2006 - [email protected] + +- converted neededforbuild to BuildRequires + +------------------------------------------------------------------- +Mon Dec 19 14:52:07 CET 2005 - [email protected] + +- added libadns.so.1 to filelist + +------------------------------------------------------------------- +Mon Apr 4 18:33:27 CEST 2005 - [email protected] + +- Make declarations of adns__parse_domain match. + +------------------------------------------------------------------- +Tue Aug 10 07:47:56 CEST 2004 - [email protected] + +- Inital SuSE RPM; [#43590]. New: ---- README.SUSE adns-1.4-configure.patch adns-1.4-destdir.patch adns-1.5.1-CVE-2017-9103.patch adns-1.5.1-CVE-2017-9104.patch adns-1.5.1-CVE-2017-9105.patch adns-1.5.1-CVE-2017-9106.patch adns-1.5.1-CVE-2017-9107.patch adns-1.5.1-CVE-2017-9108.patch adns-1.5.1-CVE-2017-9109.patch adns-1.5.1.tar.gz adns-1.5.1.tar.gz.sig adns-visibility.patch adns.changes adns.keyring adns.spec baselibs.conf ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ adns.spec ++++++ # # spec file for package adns # # Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # %define lname libadns1 Name: adns Version: 1.5.1 Release: 0 Summary: Advanced Easy-to-Use Asynchronous-Capable DNS Utilities License: GPL-2.0+ Group: Productivity/Networking/DNS/Utilities Url: http://www.chiark.greenend.org.uk/~ian/adns/ftp/ Source0: http://www.chiark.greenend.org.uk/~ian/adns/ftp/%{name}-%{version}.tar.gz Source1: http://www.chiark.greenend.org.uk/~ian/adns/ftp/%{name}-%{version}.tar.gz.sig Source2: %{name}.keyring Source3: README.SUSE Source4: baselibs.conf Patch0: adns-1.4-destdir.patch Patch1: adns-1.4-configure.patch Patch2: adns-visibility.patch Patch3: adns-1.5.1-CVE-2017-9103.patch Patch4: adns-1.5.1-CVE-2017-9104.patch Patch5: adns-1.5.1-CVE-2017-9105.patch Patch6: adns-1.5.1-CVE-2017-9106.patch Patch7: adns-1.5.1-CVE-2017-9107.patch Patch8: adns-1.5.1-CVE-2017-9108.patch Patch9: adns-1.5.1-CVE-2017-9109.patch BuildRequires: autoconf %description adns includes a collection of useful DNS resolver utilities. %package -n %{lname} Summary: Advanced DNS resolver client library Group: System/Libraries Provides: libadns = %{version} #openSUSE 10.2 Obsoletes: libadns <= 1.3 %description -n %{lname} Libadns is an advanced, easy to use, asynchronous-capable DNS resolver client library for C (and C++) programs. %package -n libadns-devel Summary: Libraries and header files to develop programs with libadns support Group: Development/Languages/C and C++ Requires: %{lname} = %{version} Requires: glibc-devel %description -n libadns-devel Libadns-devel includes the header file and static library to develop programs with libads support. %prep %setup -q %patch0 %patch1 %patch2 %patch3 -p1 %patch4 -p1 %patch5 -p1 %patch6 -p1 %patch7 -p1 %patch8 -p1 %patch9 -p1 cp %{SOURCE3} . %build autoreconf -fiv %configure make %{?_smp_mflags} all %install %make_install # FIXME: --disable-static not available rm %{buildroot}%{_libdir}/*.a %files %doc COPYING GPL-vs-LGPL README* TODO changelog %{_bindir}/adns* %files -n %{lname} %{_libdir}/libadns.so.1* %files -n libadns-devel %{_includedir}/adns.h %{_libdir}/libadns.so %post -n %{lname} -p /sbin/ldconfig %postun -n %{lname} -p /sbin/ldconfig %changelog ++++++ README.SUSE ++++++ ADNS >From the Homepage: Advanced, easy to use, asynchronous-capable DNS client library and utilities. adns is a resolver library for C (and C++) programs, and a collection of useful DNS resolver utilities. I'm (Ian) afraid there is no manual yet. However, competent C programmers should be able to use the library based on the commented adns.h header file, and the usage messages for the programs should be sufficient. adns also comes with a number of utility programs for use from the command line and in scripts: * adnslogres is a much faster version of Apache's logresolv program. * adnsresfilter is a filter which copies its input to its output, replacing IP addresses by the corresponding names, without unduly delaying the output. For example, you can usefully pipe the output of netstat -n, tcpdump -ln, and the like, into it. * adnshost is a general-purpose DNS lookup utility which can be used easily in from the command line and from shell scripts to do simple lookups. In a more advanced mode it can be used as a general-purpose DNS helper program for scripting languages which can invoke and communicate with subprocesses. See the adnshost usage message for a summary of its capabilities. >From the INSTALL file: SECURITY AND PERFORMANCE - AN IMPORTANT NOTE adns is not a `full-service resolver': it does no caching of responses at all, and has no defence against bad nameservers or fake packets which appear to come from your real nameservers. It relies on the full-service resolvers listed in resolv.conf to handle these tasks. For secure and reasonable operation you MUST run a full-service nameserver on the same system as your adns applications, or on the same local, fully trusted network. You MUST only list such nameservers in the adns configuration (eg resolv.conf). You MUST use a firewall or other means to block packets which appear to come from these nameservers, but which were actually sent by other, untrusted, entities. Furthermore, adns is not DNSSEC-aware in this version; it doesn't understand even how to ask a DNSSEC-aware nameserver to perform the DNSSEC cryptographic signature checking. In particular, adns does not randomize the query source port or transaction ID; relevant advisories are CVE-2008-1447 and CVE-2008-4100. Since adns is a stub resolver, the workarounds listed in DSA-1605-1 for glibc also apply to adns. ++++++ adns-1.4-configure.patch ++++++ --- configure.in +++ configure.in 2006/09/01 12:30:00 @@ -23,8 +23,7 @@ AC_INIT(src/adns.h) AC_CONFIG_HEADER(src/config.h) -dnl DPKG_CACHED_TRY_COMPILE(<description>,<cachevar>,<include>,<program>,<ifyes>,<ifno>) -define([DPKG_CACHED_TRY_COMPILE],[ +AC_DEFUN([DPKG_CACHED_TRY_COMPILE],[ AC_MSG_CHECKING($1) AC_CACHE_VAL($2,[ AC_TRY_COMPILE([$3],[$4],[$2=yes],[$2=no]) @@ -65,6 +64,116 @@ AC_PROG_RANLIB AC_PROG_INSTALL +AH_TOP([ +/* + * This file is + * Copyright (C) 1997-2000 Ian Jackson <[email protected]> + * + * It is part of adns, which is + * Copyright (C) 1997-2000 Ian Jackson <[email protected]> + * Copyright (C) 1999-2000 Tony Finch <[email protected]> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2, or (at your option) + * any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software Foundation, + * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ +]) + +AH_TEMPLATE([HAVE_INLINE], + [Define if inline functions a la GCC are available.]) +AH_TEMPLATE([HAVE_GNUC25_ATTRIB], + [Define if function attributes a la GCC 2.5 and higher are available.]) +AH_TEMPLATE([HAVE_GNUC25_CONST], + [Define if function attributes a la GCC 2.5 and higher are available.]) +AH_TEMPLATE([HAVE_GNUC25_NORETURN], + [Define if nonreturning functions a la GCC 2.5 and higher are available.]) +AH_TEMPLATE([HAVE_GNUC25_PRINTFFORMAT], + [Define if printf-format argument lists a la GCC are available.]) +AH_TEMPLATE([HAVEUSE_RPCTYPES_H], + [Define if we want to include rpc/types.h. Crap BSDs put INADDR_LOOPBACK there.]) + +AH_BOTTOM([ +/* Use the definitions: */ + +#ifndef HAVE_INLINE +#define inline +#endif + +#ifdef HAVE_POLL +#include <sys/poll.h> +#else +/* kludge it up */ +struct pollfd { int fd; short events; short revents; }; +#define POLLIN 1 +#define POLLPRI 2 +#define POLLOUT 4 +#endif + +/* GNU C attributes. */ +#ifndef FUNCATTR +#ifdef HAVE_GNUC25_ATTRIB +#define FUNCATTR(x) __attribute__(x) +#else +#define FUNCATTR(x) +#endif +#endif + +/* GNU C printf formats, or null. */ +#ifndef ATTRPRINTF +#ifdef HAVE_GNUC25_PRINTFFORMAT +#define ATTRPRINTF(si,tc) format(printf,si,tc) +#else +#define ATTRPRINTF(si,tc) +#endif +#endif +#ifndef PRINTFFORMAT +#define PRINTFFORMAT(si,tc) FUNCATTR((ATTRPRINTF(si,tc))) +#endif + +/* GNU C nonreturning functions, or null. */ +#ifndef ATTRNORETURN +#ifdef HAVE_GNUC25_NORETURN +#define ATTRNORETURN noreturn +#else +#define ATTRNORETURN +#endif +#endif +#ifndef NONRETURNING +#define NONRETURNING FUNCATTR((ATTRNORETURN)) +#endif + +/* Combination of both the above. */ +#ifndef NONRETURNPRINTFFORMAT +#define NONRETURNPRINTFFORMAT(si,tc) FUNCATTR((ATTRPRINTF(si,tc),ATTRNORETURN)) +#endif + +/* GNU C constant functions, or null. */ +#ifndef ATTRCONST +#ifdef HAVE_GNUC25_CONST +#define ATTRCONST const +#else +#define ATTRCONST +#endif +#endif +#ifndef CONSTANT +#define CONSTANT FUNCATTR((ATTRCONST)) +#endif + +#ifdef HAVEUSE_RPCTYPES_H +#include <rpc/types.h> +#endif +]) + AC_CHECK_FUNCS(poll) ADNS_C_GETFUNC(socket,socket) ADNS_C_GETFUNC(inet_ntoa,nsl) ++++++ adns-1.4-destdir.patch ++++++ Index: client/Makefile.in =================================================================== --- client/Makefile.in.orig +++ client/Makefile.in @@ -58,9 +58,9 @@ ALL_OBJS= $(ADH_OBJS) $(TARG_OBJS) all: $(TARGETS) install: $(TARG_INSTALL) - mkdir -p $(bindir) + $(INSTALL_PROGRAM) -d $(DESTDIR)/$(bindir) set -xe; for f in $(TARG_INSTALL); \ - do $(INSTALL_PROGRAM) $$f $(bindir)/$$f; done + do $(INSTALL_PROGRAM) $$f $(DESTDIR)/$(bindir)/$$f; done uninstall: for f in $(TARGETS); do rm -f $(bindir)/$$f; done Index: dynamic/Makefile.in =================================================================== --- dynamic/Makefile.in.orig +++ dynamic/Makefile.in @@ -30,10 +30,10 @@ include $(srcdir)/../src/adns.make ALLOBJS= $(addsuffix _p.o, $(basename $(LIBOBJS))) install: - mkdir -p $(libdir) - $(INSTALL_PROGRAM) $(SHLIBFILE) $(libdir)/$(SHLIBFILE) - ln -sf $(SHLIBFILE) $(libdir)/$(SHLIBSONAME) - ln -sf $(SHLIBSONAME) $(libdir)/$(SHLIBFORLINK) + $(INSTALL_PROGRAM) -d $(DESTDIR)/$(libdir) + $(INSTALL_PROGRAM) $(SHLIBFILE) $(DESTDIR)/$(libdir)/$(SHLIBFILE) + ln -sf $(SHLIBFILE) $(DESTDIR)/$(libdir)/$(SHLIBSONAME) + ln -sf $(SHLIBSONAME) $(DESTDIR)/$(libdir)/$(SHLIBFORLINK) uninstall: rm -f $(libdir)/$(SHLIBFILE) $(libdir)/$(SHLIBSONAME) Index: src/Makefile.in =================================================================== --- src/Makefile.in.orig +++ src/Makefile.in @@ -30,10 +30,11 @@ include $(srcdir)/adns.make DIRCFLAGS= -I. -I$(srcdir) install: - mkdir -p $(libdir) $(includedir) + $(INSTALL_PROGRAM) -d $(DESTDIR)/$(libdir) + $(INSTALL_PROGRAM) -d $(DESTDIR)/$(includedir) set -xe; for f in $(TARGETS); \ - do $(INSTALL_DATA) $$f $(libdir)/$$f; done - $(INSTALL_DATA) $(srcdir)/../src/adns.h $(includedir)/adns.h + do $(INSTALL_DATA) $$f $(DESTDIR)/$(libdir)/$$f; done + $(INSTALL_DATA) $(srcdir)/../src/adns.h $(DESTDIR)/$(includedir)/adns.h uninstall: for f in $(TARGETS); do rm -f $(libdir)/$$f; done ++++++ adns-1.5.1-CVE-2017-9103.patch ++++++ >From 020d86e2eccc2dbdfa9dcca08ddb327cc7ca3ae2 Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Wed, 23 Nov 2016 21:03:40 +0000 Subject: [PATCH 02/32] SECURITY: pap_mailbox822: Properly check st from adns__findlabel_next Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program, leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps overrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP records. Found by AFL 2.35b. CVE-2017-9103. Signed-off-by: Ian Jackson <[email protected]> --- src/types.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/types.c b/src/types.c index a4478fa..5e2bd14 100644 --- a/src/types.c +++ b/src/types.c @@ -1278,6 +1278,7 @@ static adns_status pap_mailbox822(const parseinfo *pai, pai->dgram, pai->dglen, max, *cbyte_io, cbyte_io); st= adns__findlabel_next(&fls,&lablen,&labstart); + if (st) return st; if (!lablen) { adns__vbuf_appendstr(vb,"."); goto x_ok; -- 2.20.1 ++++++ adns-1.5.1-CVE-2017-9104.patch ++++++ >From 7ba7a232de0516d2cce934bdc91627b33b46ef47 Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Thu, 1 Dec 2016 01:42:56 +0000 Subject: [PATCH 03/32] SECURITY: Do not hang, eating CPU, if we encounter a compression pointer loop Found by AFL 2.35b. CVE-2017-9104. Signed-off-by: Ian Jackson <[email protected]> --- src/parse.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/parse.c b/src/parse.c index 07d0614..790c8ce 100644 --- a/src/parse.c +++ b/src/parse.c @@ -71,6 +71,7 @@ adns_status adns__findlabel_next(findlabel_state *fls, int *lablen_r, int *labstart_r) { int lablen, jumpto; const char *dgram; + int had_pointer= 0; dgram= fls->dgram; for (;;) { @@ -81,6 +82,7 @@ adns_status adns__findlabel_next(findlabel_state *fls, if ((lablen & 0x0c0) != 0x0c0) return adns_s_unknownformat; if (fls->cbyte >= fls->dglen) goto x_truncated; if (fls->cbyte >= fls->max) goto x_badresponse; + if (had_pointer++ >= 2) goto x_loop; GET_B(fls->cbyte,jumpto); jumpto |= (lablen&0x3f)<<8; if (fls->dmend_r) *(fls->dmend_r)= fls->cbyte; @@ -109,6 +111,11 @@ adns_status adns__findlabel_next(findlabel_state *fls, adns__diag(fls->ads,fls->serv,fls->qu, "label in domain runs beyond end of domain"); return adns_s_invalidresponse; + + x_loop: + adns__diag(fls->ads,fls->serv,fls->qu, + "compressed label pointer chain"); + return adns_s_invalidresponse; } adns_status adns__parse_domain(adns_state ads, int serv, adns_query qu, -- 2.20.1 ++++++ adns-1.5.1-CVE-2017-9105.patch ++++++ >From 17afb298d90c5aafed76bd3855a5fe7dcd58594c Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Thu, 1 Dec 2016 02:48:09 +0000 Subject: [PATCH 04/32] SECURITY: adns: Do not corrupt pointer when nameserver speaks first Wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution. Found by AFL 2.35b. CVE-2017-9105. Signed-off-by: Ian Jackson <[email protected]> --- src/event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/event.c b/src/event.c index dcc49e9..b36288d 100644 --- a/src/event.c +++ b/src/event.c @@ -461,7 +461,7 @@ int adns_processwriteable(adns_state ads, int fd, const struct timeval *now) { } assert(FD_ISSET(ads->tcpsocket,&writeable)); if (!adns__vbuf_ensure(&ads->tcprecv,1)) { r= ENOMEM; goto xit; } - r= read(ads->tcpsocket,&ads->tcprecv.buf,1); + r= read(ads->tcpsocket,ads->tcprecv.buf,1); if (r==0 || (r<0 && (errno==EAGAIN || errno==EWOULDBLOCK))) { tcp_connected(ads,*now); r= 0; goto xit; -- 2.20.1 ++++++ adns-1.5.1-CVE-2017-9106.patch ++++++ A merger of these 2 patches: ----- >From 54d811a530e9cf16148998cd9fdd168dbf8e14d5 Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Sat, 3 Dec 2016 14:51:18 +0000 Subject: [PATCH 06/32] cs_inthost*: Break out csp_intofinthost No functional change. This removes some duplication, enabling the following security patch to fix just the one copy. Signed-off-by: Ian Jackson <[email protected]> --- src/types.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) ----- >From 37792aacaf7abbcdac6a02715a5ef794b5147f13 Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Sat, 3 Dec 2016 14:51:54 +0000 Subject: [PATCH 07/32] SECURITY: Defend adns_rr_info (somewhat) from bogus *datap The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps we could say that the caller ought to check these things. I think it's better to require the caller to make the pointer structure right, but to have the code here be defensive about (and tolerate with an erro but without crashing) out-of-range integer values. So: defend each of these integer conversion sites with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of range, and will overrun the buffer when reconverted. Found by AFL 2.35b. CVE-2017-9106. Signed-off-by: Ian Jackson <[email protected]> --- src/types.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) Index: adns-1.5.1/src/types.c =================================================================== --- adns-1.5.1.orig/src/types.c +++ adns-1.5.1/src/types.c @@ -1108,13 +1108,23 @@ static void mf_inthostaddr(adns_query qu mfp_hostaddr(qu,&rrp->ha); } -static adns_status cs_inthostaddr(vbuf *vb, const void *datap) { - const adns_rr_inthostaddr *rrp= datap; +static adns_status csp_intofinthost(vbuf *vb, int i) { char buf[10]; - sprintf(buf,"%u ",rrp->i); + if (i < 0 || i > 0xffff) + /* currently only used for MX whose priorities are 16-bit */ + return adns_s_invaliddata; + + sprintf(buf,"%u ",i); CSP_ADDSTR(buf); + return adns_s_ok; +} +static adns_status cs_inthostaddr(vbuf *vb, const void *datap) { + const adns_rr_inthostaddr *rrp= datap; + adns_status st; + + st = csp_intofinthost(vb,rrp->i); if (st) return st; return csp_hostaddr(vb,&rrp->ha); } @@ -1124,10 +1134,9 @@ static adns_status cs_inthostaddr(vbuf * static adns_status cs_inthost(vbuf *vb, const void *datap) { const adns_rr_intstr *rrp= datap; - char buf[10]; + adns_status st; - sprintf(buf,"%u ",rrp->i); - CSP_ADDSTR(buf); + st = csp_intofinthost(vb,rrp->i); if (st) return st; return csp_domain(vb,rrp->str); } @@ -1409,6 +1418,8 @@ static adns_status cs_soa(vbuf *vb, cons st= csp_mailbox(vb,rrp->rname); if (st) return st; for (i=0; i<5; i++) { + if (rrp->serial > 0xffffffffUL) + return adns_s_invaliddata; sprintf(buf," %lu",(&rrp->serial)[i]); CSP_ADDSTR(buf); } @@ -1497,6 +1508,10 @@ static int di_srv(adns_state ads, const static adns_status csp_srv_begin(vbuf *vb, const adns_rr_srvha *rrp /* might be adns_rr_srvraw* */) { char buf[30]; + if (rrp->priority < 0 || rrp->priority > 0xffff || + rrp->weight < 0 || rrp->weight > 0xffff || + rrp->port < 0 || rrp->port > 0xffff) + return adns_s_invaliddata; sprintf(buf,"%u %u %u ", rrp->priority, rrp->weight, rrp->port); CSP_ADDSTR(buf); return adns_s_ok; @@ -1612,6 +1627,9 @@ static adns_status cs_opaque(vbuf *vb, c int l; unsigned char *p; + if (rrp->len < 0 || rrp->len > 0xffff) + return adns_s_invaliddata; + sprintf(buf,"\\# %d",rrp->len); CSP_ADDSTR(buf); ++++++ adns-1.5.1-CVE-2017-9107.patch ++++++ >From 278f8eee581c4c4a0ddd0f98c4dc8c2974cf6b90 Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Mon, 5 Dec 2016 22:47:34 +0000 Subject: [PATCH 09/32] SECURITY: Do not overrun reading buffer if domain ends with backslash If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequence. It would depart the input buffer and start processing many bytes of arbitrary heap data as if it were the query domain. Eventually it would run out of input or find some other kind of error, and declare the query domain invalid. But before then it might outrun available memory and crash. In principle this could be a denial of service attack. Found by AFL 2.35b. CVE-2017-9107. Signed-off-by: Ian Jackson <[email protected]> --- src/transmit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/transmit.c b/src/transmit.c index 33c3329..4984986 100644 --- a/src/transmit.c +++ b/src/transmit.c @@ -87,6 +87,7 @@ static adns_status qdparselabel(adns_state ads, while (p!=pe && (c= *p++)!='.') { if (c=='\\') { if (!(flags & adns_qf_quoteok_query)) return adns_s_querydomaininvalid; + if (p==pe) return adns_s_querydomaininvalid; if (ctype_digit(p[0])) { if (p+1==pe || p+2==pe) return adns_s_querydomaininvalid; if (ctype_digit(p[1]) && ctype_digit(p[2])) { -- 2.20.1 ++++++ adns-1.5.1-CVE-2017-9108.patch ++++++ >From 72c6bfd77dfdb34457a792874fd1c3030fca90ac Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Tue, 6 Dec 2016 12:51:44 +0000 Subject: [PATCH 10/32] SECURITY: adnshost: Fix missing-final-newline handling on stdin read It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather we should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte. Found by AFL 2.35b. CVE-2017-9108. Signed-off-by: Ian Jackson <[email protected]> --- client/adh-main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/adh-main.c b/client/adh-main.c index 9709be2..31335b7 100644 --- a/client/adh-main.c +++ b/client/adh-main.c @@ -206,7 +206,7 @@ static void read_stdin(void) { if (r == 0) { if (used) { /* fake up final newline */ - buf[used++]= '\n'; + buf[used]= '\n'; r= 1; } else { ov_pipe= 0; -- 2.20.1 ++++++ adns-1.5.1-CVE-2017-9109.patch ++++++ >From fcf2b4e1faf22accb6184cca595aaee602839868 Mon Sep 17 00:00:00 2001 From: Ian Jackson <[email protected]> Date: Sat, 10 Dec 2016 23:32:49 +0000 Subject: [PATCH 11/32] SECURITY: Ignore apparent answers before first RR we found the first time This way the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this change, we prefer to look only at the answer RRs which come after the CNAME, which is at least arguably correct. Found by AFL 2.35b. CVE-2017-9109. Signed-off-by: Ian Jackson <[email protected]> --- src/reply.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/reply.c b/src/reply.c index bd2d0e8..0379ca4 100644 --- a/src/reply.c +++ b/src/reply.c @@ -35,7 +35,7 @@ void adns__procdgram(adns_state ads, const byte *dgram, int dglen, int flg_ra, flg_rd, flg_tc, flg_qr, opcode; int rrtype, rrclass, rdlength, rdstart; int anstart, nsstart; - int ownermatched, l, nrrs; + int ownermatched, l, nrrs, restartfrom; unsigned long ttl, soattl; const typeinfo *typei; adns_query qu, nqu; @@ -162,6 +162,7 @@ void adns__procdgram(adns_state ads, const byte *dgram, int dglen, * If it has any CNAMEs we stuff them in the answer. */ wantedrrs= 0; + restartfrom= -1; cbyte= anstart; for (rri= 0; rri<ancount; rri++) { rrstart= cbyte; @@ -229,6 +230,7 @@ void adns__procdgram(adns_state ads, const byte *dgram, int dglen, */ } } else if (rrtype == (qu->answer->type & adns_rrt_typemask)) { + if (restartfrom==-1) restartfrom= rri; wantedrrs++; } else { adns__debug(ads,serv,qu,"ignoring answer RR" @@ -331,12 +333,14 @@ void adns__procdgram(adns_state ads, const byte *dgram, int dglen, pai.arcount= arcount; pai.now= now; + assert(restartfrom>=0); for (rri=0, nrrs=0; rri<ancount; rri++) { st= adns__findrr(qu,serv, dgram,dglen,&cbyte, &rrtype,&rrclass,&ttl, &rdlength,&rdstart, &ownermatched); assert(!st); assert(rrtype != -1); - if (rrclass != DNS_CLASS_IN || + if (rri < restartfrom || + rrclass != DNS_CLASS_IN || rrtype != (qu->answer->type & adns_rrt_typemask) || !ownermatched) continue; -- 2.20.1 ++++++ adns-visibility.patch ++++++ Index: configure.in =================================================================== --- configure.in.orig +++ configure.in @@ -59,7 +59,9 @@ AC_ARG_ENABLE(dynamic, AC_MSG_RESULT([yes, by default]) ]) -AC_PROG_CC +AC_PROG_CC_STDC +AC_USE_SYSTEM_EXTENSIONS +AC_SYS_LARGEFILE AC_PROG_CPP AC_PROG_RANLIB AC_PROG_INSTALL Index: src/internal.h =================================================================== --- src/internal.h.orig +++ src/internal.h @@ -51,6 +51,7 @@ typedef unsigned char byte; # include "hredirect.h" #endif +#pragma GCC visibility push(hidden) /* Configuration and constants */ #define MAXSERVERS 5 @@ -944,4 +945,5 @@ static inline int errno_resources(int e) (tv)|=GETIL_B(cb), \ (tv) ) +#pragma GCC visibility pop #endif ++++++ baselibs.conf ++++++ libadns1 libadns-devel requires -libadns-<targettype> requires "libadns1-<targettype> = <version>"
