diff options
| author | Florian Weimer <fweimer@redhat.com> | 2019-01-21 21:26:03 +0100 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2019-02-04 21:36:37 +0100 |
| commit | 2373941bd73cb288c8a42a33e23e7f7bb81151e7 (patch) | |
| tree | bdfbcaa03a582c30b71e0b987030a609f7fb12be /ChangeLog | |
| parent | 37edf1d3f8ab9adefb61cc466ac52b53114fbd5b (diff) | |
| download | glibc-2373941bd73cb288c8a42a33e23e7f7bb81151e7.tar.gz glibc-2373941bd73cb288c8a42a33e23e7f7bb81151e7.tar.xz glibc-2373941bd73cb288c8a42a33e23e7f7bb81151e7.zip | |
CVE-2016-10739: getaddrinfo: Fully parse IPv4 address strings [BZ #20018]
The IPv4 address parser in the getaddrinfo function is changed so that
it does not ignore trailing whitespace and all characters after it.
For backwards compatibility, the getaddrinfo function still recognizes
legacy name syntax, such as 192.000.002.010 interpreted as 192.0.2.8
(octal).
This commit does not change the behavior of inet_addr and inet_aton.
gethostbyname already had additional sanity checks (but is switched
over to the new __inet_aton_exact function for completeness as well).
To avoid sending the problematic query names over DNS, commit
6ca53a2453598804a2559a548a08424fca96434a ("resolv: Do not send queries
for non-host-names in nss_dns [BZ #24112]") is needed.
(cherry picked from commit 108bc4049f8ae82710aec26a92ffdb4b439c83fd)
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index d774c2ef53..0db10776e6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,36 @@ +2019-01-21 Florian Weimer <fweimer@redhat.com> + + [BZ #20018] + CVE-2016-10739 + resolv: Reject trailing characters in host names + * include/arpa/inet.h (__inet_aton_exact): Declare. + (inet_aton): Remove hidden prototype. No longer used internally. + * nscd/gai.c (__inet_aton): Do not define. + * nscd/gethstbynm3_r.c (__inet_aton): Likewise. + * nss/digits_dots.c (__inet_aton): Likewise. + (__nss_hostname_digits_dots_context): Call __inet_aton_exact. + * resolv/Makefile (tests-internal): Add tst-inet_aton_exact. + (tests): Add tst-resolv-nondecimal, tst-resolv-trailing. + (tst-resolv-nondecimal): Link with libresolv.so and libpthread. + (tst-resolv-trailing): Likewise. + * resolv/Versions (GLIBC_PRIVATE): Export __inet_aton_exact from + libc. + * resolv/inet_addr.c (inet_aton_end): Remame from __inet_aton. + Make static. Add endp parameter. + (__inet_aton_exact): New function. + (__inet_aton_ignore_trailing): New function, aliased to inet_aton. + (__inet_addr): Call inet_aton_end. + * resolv/res_init.c (res_vinit_1): Truncate nameserver for IPv4, + not just IPv6. Call __inet_aton_exact. + * resolv/tst-aton.c: Switch to <support/test-driver.c>. + (tests): Make const. Add additional test cases with trailing + characters. + (do_test): Use array_length. + * resolv/tst-inet_aton_exact.c: New file. + * resolv/tst-resolv-trailing.c: Likewise. + * resolv/tst-resolv-nondecimal.c: Likewise. + * sysdeps/posix/getaddrinfo.c (gaih_inet): Call __inet_aton_exact. + 2019-01-18 Florian Weimer <fweimer@redhat.com> [BZ #24112] |