PT-2016-5212 · Isc+5 · Isc Bind+5

Publicado 2016-07-19 · Atualizado 2024-06-15 · CVE-2016-2775

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.9.x before 9.9.9-P2 ISC BIND versions 9.10.x before 9.10.4-P2 ISC BIND versions 9.11.x before 9.11.0b2

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This occurs when lwresd or the named lwres option is enabled and an overly long request is sent using the lightweight resolver protocol.

Recommendations For ISC BIND versions 9.9.x before 9.9.9-P2, update to version 9.9.9-P2 or later. For ISC BIND versions 9.10.x before 9.10.4-P2, update to version 9.10.4-P2 or later. For ISC BIND versions 9.11.x before 9.11.0b2, update to version 9.11.0b2 or later. As a temporary workaround, consider disabling the lwres option or lwresd until a patch is available.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-1464

CVE-2016-2775

DLA-645-1

DSA-3680-1

MGASA-2016-0332

OPENSUSE-SU-2017_1063-1

OPENSUSE-SU-2024:10650-1

RHSA-2017:2533

SUSE-SU-2017:0998-1

SUSE-SU-2017:0999-1

SUSE-SU-2017:1000-1

SUSE-SU-2017_0998-1

SUSE-SU-2017_0999-1

SUSE-SU-2017_1000-1

USN-5747-1

Produtos afetados

Alt Linux

Bind Server

Ibm Aix

Isc Bind

Suse

Ubuntu

Referências · 110

• 🔥 https://github.com/infobyte/CVE-2016-2776 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tsig.rb · Nota
• https://github.com/sischkg/xfer-limit/blob/master/README.md · Nota
• https://suse.com/security/cve/CVE-2021-25216 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/BXZIYU2BAM2OOY5PWMVH6AWDYLWHZXDW · Nota
• https://bugs.mageia.org/show_bug.cgi?id=18983 · Nota
• https://kb.isc.org/article/AA-01393/74/CVE-2016-2775 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3137 · Nota de Segurança
• https://suse.com/security/cve/CVE-2020-8621 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3136 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-3141 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:0998-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-5747-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-3136.html · Nota
• https://suse.com/security/cve/CVE-2020-8619 · Nota