This patch was derived from a source code patch provided by ISC to

resolve ISC ticket RT #43522. [9.6-ESV-R11-S10]

--- old/./CHANGES	Wed Jan 11 23:20:20 2017

+++ new/./CHANGES	Wed Jan 11 23:20:20 2017

@@ -1,3 +1,9 @@

+	--- 9.6-ESV-R11-S10 released ---

+

+4508.	[security]	Named incorrectly tried to cache TKEY records which

+			could trigger a assertion failure when there was

+			a class mismatch. (CVE-2016-9131) [RT #43522]

+

 	--- 9.6-ESV-R11-S9 released ---

 4489.   [security]      It was possible to trigger assertions when processing

--- old/lib/dns/resolver.c	Wed Jan 11 23:20:20 2017

+++ new/lib/dns/resolver.c	Wed Jan 11 23:20:20 2017

@@ -1,5 +1,5 @@

 /*

- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")

+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")

  * Copyright (C) 1999-2003  Internet Software Consortium.

  *

  * Permission to use, copy, modify, and/or distribute this software for any

@@ -5848,6 +5848,25 @@

 					    ISC_LOG_NOTICE, "NSEC3 in answer");

 					return (DNS_R_FORMERR);

 				}

+				if (rdataset->type == dns_rdatatype_tkey) {

+					/*

+					 * TKEY is not a valid record in a

+					 * response to any query we can make.

+					 */

+					isc_log_write(dns_lctx,

+					    DNS_LOGCATEGORY_RESOLVER,

+					    DNS_LOGMODULE_RESOLVER,

+					    ISC_LOG_NOTICE, "TKEY in answer");

+					return (DNS_R_FORMERR);

+				}

+				if (rdataset->rdclass != fctx->res->rdclass) {

+					isc_log_write(dns_lctx,

+					    DNS_LOGCATEGORY_RESOLVER,

+					    DNS_LOGMODULE_RESOLVER,

+					    ISC_LOG_NOTICE, "Mismatched class "

+						    "in answer");

+					return (DNS_R_FORMERR);

+				}

 				if (rdataset->type == type && !found_cname) {

 					/*

 					 * We've found an ordinary answer.

@@ -6017,6 +6036,15 @@

 			     rdataset != NULL;

 			     rdataset = ISC_LIST_NEXT(rdataset, link))

 			{

+				if (rdataset->rdclass != fctx->res->rdclass) {

+					isc_log_write(dns_lctx,

+					    DNS_LOGCATEGORY_RESOLVER,

+					    DNS_LOGMODULE_RESOLVER,

+					    ISC_LOG_NOTICE, "Mismatched class "

+						    "in answer");

+					return (DNS_R_FORMERR);

+				}

+

 				/*

 				 * Only pass DNAME or RRSIG(DNAME).

 				 */