PT-2016-1133 · Isc+1 · Isc Bind+1
Published
2016-01-20
·
Updated
2024-06-15
·
CVE-2015-8705
CVSS v2.0
6.6
Medium
| Vector | AV:N/AC:H/Au:N/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
ISC BIND 9.10.x versions prior to 9.10.3-P3
Description
The issue exists due to insufficient input validation, allowing a remote attacker to exploit it and potentially cause a denial of service or other impact, such as the appearance of an "Assertion failure" error window or the termination of the daemon. This can be achieved via OPT data or an ECS option when debug logging is enabled.
Recommendations
For ISC BIND 9.10.x versions prior to 9.10.3-P3, update to version 9.10.3-P3 or later to resolve the issue. As a temporary workaround, consider disabling debug logging until a patch is available. Restrict access to the
buffer.c in named to minimize the risk of exploitation. Avoid using OPT data or the ECS option in the affected API endpoint until the issue is resolved.Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bind Server
Isc Bind