SB2015121513 - Amazon Linux AMI update for bind
Published: December 15, 2015
Security Bulletin ID
SB2015121513
Severity
Medium
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Assertion failure (CVE-ID: CVE-2015-8000)
A remote attacker can trigger denial of service (DoS) conditions.The vulnerability exists due to a parsing error when processing incoming responses within db.c file. A remote attacker who can cause a server to request a record with a malformed class attribute can use this bug to trigger a REQUIRE assertion, causing named to exit and denying service to clients.
Successful exploitation of this vulnerability may allow an attacker to perform a denial of service (DoS) attack.
2) Race condition (CVE-ID: CVE-2015-8461)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via unspecified vectors.
Remediation
Install update from vendor's website.