Bug 15206 - maradns new DoS security issue
Summary: maradns new DoS security issue
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/635767/
Whiteboard: has_procedure advisory MGA4-64-OK MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-02-05 18:07 CET by David Walser
Modified: 2015-03-09 21:40 CET (History)
4 users (show)

See Also:
Source RPM: maradns-1.4.14-1.1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2015-02-05 18:07:14 CET
Upstream has issued an advisory on January 25:
http://samiam.org/blog/2015-01-25.html

The CERT issue referenced there is here:
https://www.kb.cert.org/vuls/id/264212

which is the same as the CVE-2014-8500 issue that affected BIND.

The issue is fixed upstream in 1.4.15, but there was a regression in the fix, so a really fixed 1.4.16 version is pending:
http://samiam.org/blog/2015-01-29.html

Mageia 4 is also affected.

As the upstream advisory states that 1.4.x will be EOL in June, Cauldron should be updated to 2.0.11, or the package should be dropped.

Fedora has issued an advisory for this on January 27:
https://lists.fedoraproject.org/pipermail/package-announce/2015-February/149138.html

Reproducible: 

Steps to Reproduce:
David Walser 2015-02-05 18:07:39 CET

CC: (none) => makowski.mageia
Blocks: (none) => 14674
Whiteboard: (none) => MGA4TOO

Comment 1 David Walser 2015-02-09 21:04:16 CET
LWN gave maradns its own entry for this (since it wouldn't technically be the same CVE, as it's different software).  The BIND CVE-2014-8500 one was here:
http://lwn.net/Vulnerabilities/625159/

URL: http://lwn.net/Vulnerabilities/625159/ => http://lwn.net/Vulnerabilities/632576/
Summary: maradns new security issue CVE-2014-8500 => maradns new DoS security issue

Comment 2 David Walser 2015-02-10 01:28:56 CET
LWN moved the maradns ones to both be on the BIND vuln entry.

URL: http://lwn.net/Vulnerabilities/632576/ => http://lwn.net/Vulnerabilities/625159/

Remco Rijnders 2015-02-10 13:07:32 CET

Status: NEW => ASSIGNED

Philippe Makowski 2015-02-21 19:03:29 CET

CC: makowski.mageia => (none)

Comment 3 David Walser 2015-02-23 14:47:16 CET
Dropped from Cauldron for now.  Feel free to resubmit it to Mageia 5 once it has been updated to 2.0.x.

Version: Cauldron => 4
Blocks: 14674 => (none)
Whiteboard: MGA4TOO => (none)

Comment 4 Remco Rijnders 2015-03-03 13:57:54 CET
1.4.16 is available in core/updates_testing.

No testing procedure is available, but I think verifying that the package installs and runs (see: https://wiki.mageia.org/en/QA_procedure:Maradns ) should suffice.

CC: (none) => remco
Assignee: remco => qa-bugs

Comment 5 David Walser 2015-03-03 15:33:08 CET
Thanks Remmy!

That will suffice as a testing procedure.

Could you write an advisory for this one?

Whiteboard: (none) => has_procedure

Comment 6 olivier charles 2015-03-03 16:07:12 CET
Testing on Mageia4x64 real hardware

From current package :
--------------------
maradns-1.4.14-1.1.mga4.x86_64

# systemctl start maradns 
didn't work as it complained port 53 was already in use.
Had to reboot to start maradns
Followed procedure mentionned in comment 4.
OK

maradns-1.4.16-1.1.mga4.x86_64
Rebooted
# systemctl status -l maradns
maradns.service - MaraDNS secure Domain Name Server (DNS)
   Loaded: loaded (/usr/lib/systemd/system/maradns.service; enabled)
   Active: active (running) since mar. 2015-03-03 16:02:19 CET; 42s ago
 Main PID: 1759 (maradns)
   CGroup: /system.slice/maradns.service
           ââ1759 /usr/sbin/maradns -f /etc/maradns/mararc.recursive

Followed same procedure
OK

CC: (none) => olchal
Whiteboard: has_procedure => has_procedure MGA4-64-OK

Comment 7 William Kenney 2015-03-04 20:43:05 CET
In VirtualBox, M4, KDE, 32-bit

Package(s) under test:
maradns

default install of maradns

[root@localhost wilcal]# urpmi maradns
Package maradns-1.4.14-1.1.mga4.i586 is already installed

[root@localhost wilcal]# systemctl start maradns
seemed to start ok

install maradns from updates_testing

[root@localhost wilcal]# urpmi maradns
Package maradns-1.4.16-1.1.mga4.i586 is already installed

Seemed to install, stop and restart just fine.

[root@localhost wilcal]# systemctl status -l maradns
maradns.service - MaraDNS secure Domain Name Server (DNS)
   Loaded: loaded (/usr/lib/systemd/system/maradns.service; enabled)
   Active: active (running) since Wed 2015-03-04 11:37:59 PST; 3min 18s ago
 Main PID: 13017 (maradns)
   CGroup: /system.slice/maradns.service
           ââ13017 /usr/sbin/maradns -f /etc/maradns/mararc.recursive

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

CC: (none) => wilcal.int

Comment 8 William Kenney 2015-03-04 20:43:58 CET
Looks ok. Your call olivier.
Comment 9 olivier charles 2015-03-04 22:33:53 CET
Testing on Mageia4x32 real hardware,

maradns-1.4.16-1.1.mga4 testing package

I had same good results as William

Configured as a recursive dns server, maradns worked well.

OK then.

Whiteboard: has_procedure MGA4-64-OK => has_procedure MGA4-64-OK MGA4-32-OK

Comment 10 Remco Rijnders 2015-03-05 07:33:42 CET
Thanks for testing guys!

Advisory:
=========
maradns versions prior to 1.4.16 are vulnerable to a DoS-vulnerability through which a malicious authorative DNS-server can cause an infinite chain of referrals.

For further details on the vulnerability, see https://www.kb.cert.org/vuls/id/264212

This update closes mga#15206
Comment 11 claire robinson 2015-03-05 17:48:01 CET
Validating. Advisory uploaded without CVE reference.

Do you want to add one?

Please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA4-64-OK MGA4-32-OK => has_procedure advisory MGA4-64-OK MGA4-32-OK
CC: (none) => sysadmin-bugs

Comment 12 David Walser 2015-03-05 17:49:32 CET
Technically this one doesn't have its own CVE.
Comment 13 Mageia Robot 2015-03-05 20:35:01 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0092.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 14 David Walser 2015-03-06 22:34:29 CET
LWN created this entry:
http://lwn.net/Vulnerabilities/635767/

Not sure if they'll keep it or merge it back into the BIND one.  I gave them a heads up.  Our advisory should grouped with the Fedora maradns ones, one way or another.
Comment 15 David Walser 2015-03-09 21:40:23 CET
Yep, they grouped the Fedora maradns advisories with ours, so maradns will keep its own page, which makes sense.

URL: http://lwn.net/Vulnerabilities/625159/ => http://lwn.net/Vulnerabilities/635767/


Note You need to log in before you can comment on or make changes to this bug.