Denial of service in ISC products - CVE-2016-8864

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU1132

Denial of service in ISC products - CVE-2016-8864

Published: November 1, 2016 / Updated: January 11, 2017


Vulnerability identifier: #VU1132
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8864
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to imptoper input validation. By returning a recursive response containing a specially crafted DNAME answer, a remote attacker can trigger a flaw in 'db.c' or 'resolver.c' and cause the target resolver to crash.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Affected software

Oracle VM Server for x86
Dell EMC Unisphere Central
Oracle Linux
Oracle Solaris
Gentoo Linux
Arch Linux
Amazon Linux AMI
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64
SUSE Linux
Ubuntu
Slackware Linux
Fedora
ISC BIND
bind (Alpine package)
bind99
bind

How to mitigate CVE-2016-8864

Update to version 9.9.9-P4, 9.10.4-P4, 9.11.0-P1.

bind (Alpine package) - addressed in versions 9.10.4_p3-r1, 9.10.4_p4-r0
Dell EMC Unisphere Central - update to 4.0.7
bind99 - addressed in versions 9.9.9-2.P4.fc23, 9.9.9-2.P4.fc24, 9.9.9-2.P4.fc25, 9.9.9-4.P4.fc23, 9.9.9-4.P4.fc24, 9.9.9-4.P4.fc25, 9.9.9-4.P6.fc24, 9.9.9-4.P6.fc25
bind - addressed in versions 9.10.4-2.P4.fc23, 9.10.4-2.P4.fc24, 9.10.4-2.P4.fc25

External References

Related Security Bulletins