ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

[v9_9] quote service registry paths

Browse Source 
4532.	[security]	The BIND installer on Windows used an unquoted
                        service path, which can enable privilege escalation.
			(CVE-2017-3141) [RT #45229]

(cherry picked from commit 967a3b9419)
(cherry picked from commit c28e44f3f8)
This commit is contained in:
Evan Hunt
2017-05-30 13:39:28 -07:00
parent 10f80ef83a
commit ef0f8427a2
5 changed files with 41 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
4532. [security] The BIND installer on Windows used an unquoted
service path, which can enable privilege escalation.
(CVE-2017-3141) [RT #45229]
4531. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]

4
README
View File

@@ -231,8 +231,8 @@ CVE-2017-3137, and CVE-2017-3138.
BIND 9.9.11
BIND 9.9.11 is a maintenance release, and addresses the security flaw
disclosed in CVE-2017-3140.
BIND 9.9.11 is a maintenance release, and addresses the security flaws
disclosed in CVE-2017-3140 and CVE-2017-3141.
Building BIND

4
README.md
View File

@@ -248,8 +248,8 @@ CVE-2017-3135, CVE-2017-3136, CVE-2017-3137, and CVE-2017-3138.
#### BIND 9.9.11
BIND 9.9.11 is a maintenance release, and addresses the security flaw
disclosed in CVE-2017-3140.
BIND 9.9.11 is a maintenance release, and addresses the security flaws
disclosed in CVE-2017-3140 and CVE-2017-3141.
### <a name="build"/> Building BIND

29
bin/win32/BINDInstall/BINDInstallDlg.cpp
View File

@@ -59,6 +59,7 @@
#include "DirBrowse.h"
#include <winsvc.h>
#include <shlobj.h>
#include <shlwapi.h>
#include <named/ntservice.h>
#include <isc/bind_registry.h>
#include <isc/ntgroups.h>
@@ -615,8 +616,16 @@ void CBINDInstallDlg::OnInstall() {
(LPBYTE)(LPCTSTR)buf, buf.GetLength());
buf.Format("%s\\BINDInstall.exe", m_binDir);
CStringA installLocA(buf);
const char *str = (const char *) installLocA;
char pathBuffer[2 * MAX_PATH];
strncpy(pathBuffer, str, sizeof(pathBuffer) - 1);
pathBuffer[sizeof(pathBuffer) - 1] = 0;
PathQuoteSpaces(pathBuffer);
RegSetValueEx(hKey, "UninstallString", 0, REG_SZ,
(LPBYTE)(LPCTSTR)buf, buf.GetLength());
(LPBYTE)(LPCTSTR)pathBuffer, strlen(pathBuffer));
RegCloseKey(hKey);
}
@@ -1011,10 +1020,17 @@ CBINDInstallDlg::RegisterService() {
CString namedLoc;
namedLoc.Format("%s\\bin\\named.exe", m_targetDir);
CStringA namedLocA(namedLoc);
const char *str = (const char *) namedLocA;
char pathBuffer[2 * MAX_PATH];
strncpy(pathBuffer, str, sizeof(pathBuffer) - 1);
pathBuffer[sizeof(pathBuffer) - 1] = 0;
PathQuoteSpaces(pathBuffer);
SetCurrent(IDS_CREATE_SERVICE);
hService = CreateService(hSCManager, BIND_SERVICE_NAME,
BIND_DISPLAY_NAME, SERVICE_ALL_ACCESS, dwServiceType, dwStart,
SERVICE_ERROR_NORMAL, namedLoc, NULL, NULL, NULL, StartName,
SERVICE_ERROR_NORMAL, pathBuffer, NULL, NULL, NULL, StartName,
m_accountPassword);
if (!hService && GetLastError() != ERROR_SERVICE_EXISTS)
@@ -1053,6 +1069,13 @@ CBINDInstallDlg::UpdateService(CString StartName) {
CString namedLoc;
namedLoc.Format("%s\\bin\\named.exe", m_targetDir);
CStringA namedLocA(namedLoc);
const char *str = (const char *) namedLocA;
char pathBuffer[2 * MAX_PATH];
strncpy(pathBuffer, str, sizeof(pathBuffer) - 1);
pathBuffer[sizeof(pathBuffer) - 1] = 0;
PathQuoteSpaces(pathBuffer);
SetCurrent(IDS_OPEN_SERVICE);
hService = OpenService(hSCManager, BIND_SERVICE_NAME,
SERVICE_CHANGE_CONFIG);
@@ -1064,7 +1087,7 @@ CBINDInstallDlg::UpdateService(CString StartName) {
return;
} else {
if (ChangeServiceConfig(hService, dwServiceType, dwStart,
SERVICE_ERROR_NORMAL, namedLoc, NULL, NULL, NULL,
SERVICE_ERROR_NORMAL, pathBuffer, NULL, NULL, NULL,
StartName, m_accountPassword, BIND_DISPLAY_NAME)
!= TRUE) {
DWORD err = GetLastError();

7
doc/arm/notes.xml
View File

@@ -71,6 +71,13 @@
<section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
<itemizedlist>
<listitem>
<para>
The BIND installer on Windows used an unquoted service path,
which can enable privilege escalation. This flaw is disclosed
in CVE-2017-3141. [RT #45229]
</para>
</listitem>
<listitem>
<para>
With certain RPZ configurations, a response with TTL 0