AXFR/IXFR response processing flaw in BIND in ISC BIND - CVE-2016-6170

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU103

AXFR/IXFR response processing flaw in BIND in ISC BIND - CVE-2016-6170

Published: July 8, 2016 / Updated: January 21, 2021


Vulnerability identifier: #VU103
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-6170
CWE-ID: CWE-233
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: ISC
Affected software:
ISC BIND

Detailed vulnerability description

The vulnerability allows a remote attacker to cause the target service to crash.

The vulnerability exists due to resource error in BIND. A remote primary DNS server can cause the target secondary DNS server to crash by sending a specially crafted AXFR response or IXFR response. A remote unauthenticated attacker may be able to send a specially crafted UPDATE message to cause the target server to crash.

Successful exploitation of this vulnerability may result in denial of service.


How to mitigate CVE-2016-6170

Cybersecurity Help is currently unaware of any official solution, which resolves this vulnerability.

A third-party unofficial patch is available at: https://github.com/sischkg/xfer-limit.


Sources