Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 7 Jul 2015 21:43:25 +0000 (UTC)
From:      Xin LI <delphij@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org
Subject:   svn commit: r285257 - in stable: 8/contrib/bind9/lib/dns 9/contrib/bind9/lib/dns
Message-ID:  <201507072143.t67LhPib035146@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: delphij
Date: Tue Jul  7 21:43:23 2015
New Revision: 285257
URL: https://svnweb.freebsd.org/changeset/base/285257

Log:
  Fix BIND resolver remote denial of service when validating.
  
  Security:	CVE-2015-4620
  Security:	FreeBSD-SA-15:11.bind

Modified:
  stable/8/contrib/bind9/lib/dns/validator.c

Changes in other areas also in this revision:
Modified:
  stable/9/contrib/bind9/lib/dns/validator.c

Modified: stable/8/contrib/bind9/lib/dns/validator.c
==============================================================================
--- stable/8/contrib/bind9/lib/dns/validator.c	Tue Jul  7 21:05:20 2015	(r285256)
+++ stable/8/contrib/bind9/lib/dns/validator.c	Tue Jul  7 21:43:23 2015	(r285257)
@@ -1406,7 +1406,6 @@ compute_keytag(dns_rdata_t *rdata, dns_r
  */
 static isc_boolean_t
 isselfsigned(dns_validator_t *val) {
-	dns_fixedname_t fixed;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_t sigrdata = DNS_RDATA_INIT;
@@ -1461,7 +1460,7 @@ isselfsigned(dns_validator_t *val) {
 
 			result = dns_dnssec_verify2(name, rdataset, dstkey,
 						    ISC_TRUE, mctx, &sigrdata,
-						    dns_fixedname_name(&fixed));
+						    NULL);
 			dst_key_free(&dstkey);
 			if (result != ISC_R_SUCCESS)
 				continue;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201507072143.t67LhPib035146>