Input validation error in bind (Alpine package)
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2016-9147 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
bind (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Input validation error
EUVDB-ID: #VU4349
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-9147
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause denial of service conditions.
The vulnerability exists due to assertion failure when processing input data. A remote attacker can send a response containing an inconsistency among the DNSSEC-related RRsets, trigger assertion failure and cause denial of service.
Successful exploitation of the vulnerability will result in DoS attack against vulnerable application.
Mitigation
Install update from vendor's website.
Vulnerable software versionsbind (Alpine package): 9.10.4_p3-r0 - 9.10.4_p4-r0
External linkshttp://git.alpinelinux.org/aports/commit/?id=c38ff6c4c17ad578319bf6efda6b7f8ccd21640b
http://git.alpinelinux.org/aports/commit/?id=95378b844fdafeac63ebaaa24ca8f0b0da3f3978
http://git.alpinelinux.org/aports/commit/?id=50ad495539ff98e25828fd2aee3bf1a67a6c3195
http://git.alpinelinux.org/aports/commit/?id=db19c120bc6d032b9f6fa773b7875be828dcfd62
http://git.alpinelinux.org/aports/commit/?id=859db39dd1ffc64c813d886d9fa7a4eb04e08024
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
