Sun May 11 09:33:42 2008 UTC ()
Pullup ticket 2369 - requested by tonnerre
security fix for bind 8

- pkgsrc/net/bind8/Makefile				1.40
- pkgsrc/net/bind8/distinfo				1.22
- pkgsrc/net/bind8/patches/patch-ao			1.1

   Module Name:	pkgsrc
   Committed By:	tonnerre
   Date:		Sun May 11 00:00:57 UTC 2008

   Modified Files:
	   pkgsrc/net/bind8: Makefile distinfo
   Added Files:
	   pkgsrc/net/bind8/patches: patch-ao

   Log Message:
   Fix CVE-2008-0122 for libbind (as contained in bind). A misplaced
   boundary check can be abused for implementation specific exploitation:
   depending on the use of libbind, this can result in denial of service
   or even remote code execution.


(ghen)
diff -r1.39 -r1.39.4.1 pkgsrc/net/bind8/Makefile
diff -r1.21 -r1.21.6.1 pkgsrc/net/bind8/distinfo
diff -r0 -r1.1.2.2 pkgsrc/net/bind8/patches/patch-ao
cvs diff -r1.39 -r1.39.4.1 pkgsrc/net/bind8/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/net/bind8/Attic/Makefile 2007/11/17 12:04:13 1.39
+++ pkgsrc/net/bind8/Attic/Makefile 2008/05/11 09:33:42 1.39.4.1
@@ -1,17 +1,18 @@ @@ -1,17 +1,18 @@
1# $NetBSD: Makefile,v 1.39 2007/11/17 12:04:13 rillig Exp $ 1# $NetBSD: Makefile,v 1.39.4.1 2008/05/11 09:33:42 ghen Exp $
2 2
3DISTNAME= bind-${BIND_VERSION} 3DISTNAME= bind-${BIND_VERSION}
4PKGNAME= ${DISTNAME}pl1 4PKGNAME= ${DISTNAME}pl1
 5PKGREVISION= 1
5CATEGORIES= net 6CATEGORIES= net
6MASTER_SITES= ftp://ftp.isc.org/isc/bind8/src/${BIND_VERSION}/ 7MASTER_SITES= ftp://ftp.isc.org/isc/bind8/src/${BIND_VERSION}/
7DISTFILES= bind-src.tar.gz bind-doc.tar.gz 8DISTFILES= bind-src.tar.gz bind-doc.tar.gz
8 9
9MAINTAINER= pkgsrc-users@NetBSD.org 10MAINTAINER= pkgsrc-users@NetBSD.org
10HOMEPAGE= http://www.isc.org/sw/bind/ 11HOMEPAGE= http://www.isc.org/sw/bind/
11COMMENT= The Berkeley Internet Name Daemon, an implementation of DNS 12COMMENT= The Berkeley Internet Name Daemon, an implementation of DNS
12 13
13USE_TOOLS+= lex yacc 14USE_TOOLS+= lex yacc
14 15
15WRKSRC= ${WRKDIR} 16WRKSRC= ${WRKDIR}
16BIND_VERSION= 8.4.7 17BIND_VERSION= 8.4.7
17DIST_SUBDIR= bind/${BIND_VERSION} 18DIST_SUBDIR= bind/${BIND_VERSION}
cvs diff -r1.21 -r1.21.6.1 pkgsrc/net/bind8/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/net/bind8/Attic/distinfo 2007/09/10 19:05:01 1.21
+++ pkgsrc/net/bind8/Attic/distinfo 2008/05/11 09:33:42 1.21.6.1
@@ -1,24 +1,25 @@ @@ -1,24 +1,25 @@
1$NetBSD: distinfo,v 1.21 2007/09/10 19:05:01 adrianp Exp $ 1$NetBSD: distinfo,v 1.21.6.1 2008/05/11 09:33:42 ghen Exp $
2 2
3SHA1 (bind/8.4.7/8.4.7-p1.patch) = 21ace372a55ff10166c3aaefb9ca25889b8e9c99 3SHA1 (bind/8.4.7/8.4.7-p1.patch) = 21ace372a55ff10166c3aaefb9ca25889b8e9c99
4RMD160 (bind/8.4.7/8.4.7-p1.patch) = 09787da6ebf107f680963ead6b9998f734244951 4RMD160 (bind/8.4.7/8.4.7-p1.patch) = 09787da6ebf107f680963ead6b9998f734244951
5Size (bind/8.4.7/8.4.7-p1.patch) = 47224 bytes 5Size (bind/8.4.7/8.4.7-p1.patch) = 47224 bytes
6SHA1 (bind/8.4.7/bind-doc.tar.gz) = 69baf042cbceaa81485db12f9d877f14a4e4d0f6 6SHA1 (bind/8.4.7/bind-doc.tar.gz) = 69baf042cbceaa81485db12f9d877f14a4e4d0f6
7RMD160 (bind/8.4.7/bind-doc.tar.gz) = 83a19daac958f41e5cac1dea3201d959658744a8 7RMD160 (bind/8.4.7/bind-doc.tar.gz) = 83a19daac958f41e5cac1dea3201d959658744a8
8Size (bind/8.4.7/bind-doc.tar.gz) = 1492480 bytes 8Size (bind/8.4.7/bind-doc.tar.gz) = 1492480 bytes
9SHA1 (bind/8.4.7/bind-src.tar.gz) = a5f352ca020403bc0f70c6201809c9ba9e56932a 9SHA1 (bind/8.4.7/bind-src.tar.gz) = a5f352ca020403bc0f70c6201809c9ba9e56932a
10RMD160 (bind/8.4.7/bind-src.tar.gz) = 87ea8fb441d100da49b2f46e1c32d12c9e2322a7 10RMD160 (bind/8.4.7/bind-src.tar.gz) = 87ea8fb441d100da49b2f46e1c32d12c9e2322a7
11Size (bind/8.4.7/bind-src.tar.gz) = 1484718 bytes 11Size (bind/8.4.7/bind-src.tar.gz) = 1484718 bytes
12SHA1 (patch-aa) = c94c78cb904e713be25da748d3ecfed51b2ed010 12SHA1 (patch-aa) = c94c78cb904e713be25da748d3ecfed51b2ed010
13SHA1 (patch-ab) = 41c03679a97d24302f4eb4bec67fda0b8d4cd9bf 13SHA1 (patch-ab) = 41c03679a97d24302f4eb4bec67fda0b8d4cd9bf
14SHA1 (patch-ad) = 8b7071e89179af3de5c7645b88d175bb9143a9da 14SHA1 (patch-ad) = 8b7071e89179af3de5c7645b88d175bb9143a9da
15SHA1 (patch-ae) = e0bf370c94d412fbb3347dfa2fd74a164d7cd944 15SHA1 (patch-ae) = e0bf370c94d412fbb3347dfa2fd74a164d7cd944
16SHA1 (patch-af) = f697c119f38a5e0f1aeeafe4a77e8c1436ec684a 16SHA1 (patch-af) = f697c119f38a5e0f1aeeafe4a77e8c1436ec684a
17SHA1 (patch-ag) = 399938ee154d671232b87371d8cc7d3b2c419cd7 17SHA1 (patch-ag) = 399938ee154d671232b87371d8cc7d3b2c419cd7
18SHA1 (patch-ah) = 154d3ab6a388a51dbfc1351a7d21e9436f5efa92 18SHA1 (patch-ah) = 154d3ab6a388a51dbfc1351a7d21e9436f5efa92
19SHA1 (patch-ai) = 44090a2cdada15245f5557af13d23061feba54d0 19SHA1 (patch-ai) = 44090a2cdada15245f5557af13d23061feba54d0
20SHA1 (patch-aj) = 6a812ee56aad252c44b7fd0eb839d9d382f1ef6a 20SHA1 (patch-aj) = 6a812ee56aad252c44b7fd0eb839d9d382f1ef6a
21SHA1 (patch-ak) = db59ad1cda56adfffb75336781c4bd1ad1c79733 21SHA1 (patch-ak) = db59ad1cda56adfffb75336781c4bd1ad1c79733
22SHA1 (patch-al) = f03b3b5480d9294673cdb86cf0f45f48ce9ea895 22SHA1 (patch-al) = f03b3b5480d9294673cdb86cf0f45f48ce9ea895
23SHA1 (patch-am) = 7acd974e10388dba0dcb44c28f2f03e18b7a1c28 23SHA1 (patch-am) = 7acd974e10388dba0dcb44c28f2f03e18b7a1c28
24SHA1 (patch-an) = 41b63a50756d9f73152fc8a48dbf93657064e90f 24SHA1 (patch-an) = 41b63a50756d9f73152fc8a48dbf93657064e90f
 25SHA1 (patch-ao) = 85ee16824e849ad227e04dbf71808446769438af
File Added: pkgsrc/net/bind8/patches/Attic/patch-ao
$NetBSD: patch-ao,v 1.1.2.2 2008/05/11 09:33:42 ghen Exp $

--- src/lib/inet/inet_network.c.orig	2004-03-17 01:20:24.000000000 +0100
+++ src/lib/inet/inet_network.c
@@ -84,9 +84,9 @@ again:
 	}
 	if (!digit)
 		return (INADDR_NONE);
+	if (pp >= parts + 4 || val > 0xffU)
+		return (INADDR_NONE);
 	if (*cp == '.') {
-		if (pp >= parts + 4 || val > 0xffU)
-			return (INADDR_NONE);
 		*pp++ = val, cp++;
 		goto again;
 	}