From 6bd82ee4a5b1c40e3029bbcfadbb51fec5987f37 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Tue, 3 Feb 2015 18:25:58 -0800
Subject: [PATCH] [v9_10] avoid crash due to managed-key rollover

4053.	[security]	Revoking a managed trust anchor and supplying
			an untrusted replacement could cause named
			to crash with an assertion failure.
			(CVE-2015-1349) [RT #38344]
---
 CHANGES           |  5 +++++
 doc/arm/notes.xml | 19 +++++++++++++++++++
 lib/dns/zone.c    |  8 +++++++-
 3 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 7e8d6696a1..e0ddd03c20 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+4053.	[security]	Revoking a managed trust anchor and supplying
+			an untrusted replacement could cause named
+			to crash with an assertion failure.
+			(CVE-2015-1349) [RT #38344]
+
 4052.	[bug]		Fix a leak of query fetchlock. [RT #38454]
 
 4051.	[bug]		Fix a leak of pthread_mutexattr_t. [RT #38454]
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 006ae46bc3..699a01d70e 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -38,6 +38,25 @@
   <sect2 id="relnotes_security">
     <title>Security Fixes</title>
     <itemizedlist>
+      <listitem>
+	<para>
+	  On servers configured to perform DNSSEC validation using
+	  managed trust anchors (i.e., keys configured explicitly
+	  via <command>managed-keys</command>, or implicitly 
+	  via <command>dnssec-validation auto;</command> or
+	  <command>dnssec-lookaside auto;</command>), revoking
+	  a trust anchor and sending a new untrusted replacement
+	  could cause <command>named</command> to crash with an
+	  assertion failure. This could occur in the event of a
+	  botched key rollover, or potentially as a result of a
+	  deliberate attack if the attacker was in position to
+	  monitor the victim's DNS traffic.
+	</para>
+	<para>
+	  This flaw was discovered by Jan-Piet Mens, and is
+	  disclosed in CVE-2015-1349. [RT #38344]
+	</para>
+      </listitem>
       <listitem>
 	<para>
 	  A flaw in delegation handling could be exploited to put
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 6e0eeb23cb..242694a448 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8971,6 +8971,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 					     namebuf, tag);
 				trustkey = ISC_TRUE;
 			}
+		} else {
+			/*
+			 * No previously known key, and the key is not
+			 * secure, so skip it.
+			 */
+			continue;
 		}
 
 		/* Delete old version */
@@ -9019,7 +9025,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 			trust_key(zone, keyname, &dnskey, mctx);
 		}
 
-		if (!deletekey) {
+		if (secure && !deletekey) {
 			INSIST(newkey || updatekey);
 			set_refreshkeytimer(zone, &keydata, now);
 		}