PT-2016-1133 · Isc+1 · Isc Bind+1
Publicado
2016-01-20
·
Atualizado
2024-06-15
·
CVE-2015-8705
CVSS v2.0
6.6
Média
| Vetor | AV:N/AC:H/Au:N/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
ISC BIND 9.10.x versions prior to 9.10.3-P3
Description
The issue exists due to insufficient input validation, allowing a remote attacker to exploit it and potentially cause a denial of service or other impact, such as the appearance of an "Assertion failure" error window or the termination of the daemon. This can be achieved via OPT data or an ECS option when debug logging is enabled.
Recommendations
For ISC BIND 9.10.x versions prior to 9.10.3-P3, update to version 9.10.3-P3 or later to resolve the issue. As a temporary workaround, consider disabling debug logging until a patch is available. Restrict access to the
buffer.c in named to minimize the risk of exploitation. Avoid using OPT data or the ECS option in the affected API endpoint until the issue is resolved.Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bind Server
Isc Bind