PT-2016-3305 · Isc+8 · Isc Bind 9.X+8

Marco Davids + 1 · Publicado 2016-02-11 · Atualizado 2024-06-15 · CVE-2016-8864

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ISC BIND 9.x versions 9.9.9 through 9.9.9-P3 ISC BIND 9.x versions 9.10.x through 9.10.4-P3 ISC BIND 9.x versions 9.11.x through 9.11.0

Description The issue is related to errors in data processing, which can be exploited by a remote attacker to cause a denial of service. This can be achieved by sending a specially crafted DNS packet with malformed options, triggering an assertion failure. The vulnerability is also related to DNAME records in the answer section of a response to a recursive query.

Recommendations For ISC BIND 9.x versions 9.9.9 through 9.9.9-P3, update to version 9.9.9-P4 or later. For ISC BIND 9.x versions 9.10.x through 9.10.4-P3, update to version 9.10.4-P4 or later. For ISC BIND 9.x versions 9.11.x through 9.11.0, update to version 9.11.0-P1 or later.

Correção

DoS

Assertion Failure

Enumeração de Fraquezas

CWE-19

CWE-617

Identificadores relacionados

ALT-PU-2016-2242

ALT-PU-2017-1464

BDU:2020-00776

CESA-2016_2141

CESA-2016_2615

CVE-2016-8864

DLA-696-1

DSA-3703-1

DSA-3795-1

FREEBSD-SA-16_34

MGASA-2016-0365

OPENSUSE-SU-2016_2738-1

OPENSUSE-SU-2016_2739-1

OPENSUSE-SU-2024:10467-1

RHSA-2016:2141

RHSA-2016:2142

RHSA-2016:2615

RHSA-2016:2871

RHSA-2016_2141

RHSA-2016_2142

RHSA-2016_2615

RHSA-2017:1583

SUSE-SU-2016:2696-1

SUSE-SU-2016:2697-1

SUSE-SU-2016:2697-2

SUSE-SU-2016:2706-1

SUSE-SU-2016_2696-1

SUSE-SU-2016_2697-1

SUSE-SU-2016_2706-1

USN-3119-1

Produtos afetados

Alt Linux

Bind Server

Centos

Freebsd

Ibm Aix

Isc Bind 9.X

Red Hat

Suse

Ubuntu

Referências · 126

• https://github.com/sischkg/xfer-limit/blob/master/README.md · Nota
• http://rhn.redhat.com/errata/RHSA-2016-2871.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-8864 · Aviso do Fabricante
• https://bugzilla.suse.com/965748 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8864 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1389652 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3137 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-2776 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3136 · Nota de Segurança
• https://kb.isc.org/article/AA-01437 · Nota
• https://suse.com/security/cve/CVE-2015-1349 · Nota
• https://suse.com/security/cve/CVE-2016-2088 · Nota
• https://ubuntu.com/security/notices/USN-3119-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2016-0365.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2011-0414 · Nota