Input validation error in ISC BIND - CVE-2015-8704
Published: January 20, 2016 / Updated: July 27, 2020
Vulnerability identifier: #VU31952
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8704
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.
apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.
Affected software
ISC BIND
Amazon Linux AMI
SUSE Linux
Slackware Linux
Fedora
Opensuse
bind (Alpine package)
bind99
bind
Dell EMC Unisphere Central
Amazon Linux AMI
SUSE Linux
Slackware Linux
Fedora
Opensuse
bind (Alpine package)
bind99
bind
Dell EMC Unisphere Central
How to mitigate CVE-2015-8704
Install update from vendor's website.
bind (Alpine package) - update to 9.10.3_p3-r0
Dell EMC Unisphere Central - update to 4.0.7
bind99 - addressed in versions 9.9.8-2.P3.fc22, 9.9.8-2.P3.fc23
bind - addressed in versions 9.10.3-8.P3.fc22, 9.10.3-10.P3.fc23
Dell EMC Unisphere Central - update to 4.0.7
bind99 - addressed in versions 9.9.8-2.P3.fc22, 9.9.8-2.P3.fc23
bind - addressed in versions 9.10.3-8.P3.fc22, 9.10.3-10.P3.fc23
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178045.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175973.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html
- http://marc.info/?l=bugtraq&m=145680832702035&w=2
- http://rhn.redhat.com/errata/RHSA-2016-0073.html
- http://rhn.redhat.com/errata/RHSA-2016-0074.html
- http://www.debian.org/security/2016/dsa-3449
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/81329
- http://www.securitytracker.com/id/1034739
- http://www.ubuntu.com/usn/USN-2874-1
- https://kb.isc.org/article/AA-01335
- https://kb.isc.org/article/AA-01380
- https://kb.isc.org/article/AA-01438
- https://security.gentoo.org/glsa/201610-07
- https://www.freebsd.org/security/advisories/FreeBSD-SA-16:08.bind.asc
Related Security Bulletins
- Input validation error in ISC BIND
- SUSE Linux update for bind
- SUSE Linux update for bind
- OpenSUSE Linux update for bind
- SUSE Linux update for bind
- SUSE Linux update for bind
- Input validation error in bind (Alpine package)
- Amazon Linux AMI update for bind
- Slackware Linux update for bind
- Multiple vulnerabilities in Dell EMC Unisphere Central
- Fedora 23 update for bind
- Fedora 22 update for bind
- Fedora 22 update for bind99
- Fedora 23 update for bind99