Input validation error in ISC BIND - CVE-2015-8704

Vulnerability identifier: #VU31952

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-8704

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.

ISC BIND
Amazon Linux AMI
SUSE Linux
Ubuntu
Slackware Linux
Fedora
Opensuse
bind (Alpine package)
bind9 (Ubuntu package)
bind99
bind
Dell EMC Unisphere Central

Install update from vendor's website.

bind (Alpine package) - update to 9.10.3_p3-r0
bind9 (Ubuntu package) - addressed in versions 1:9.8.1.dfsg.P1-4ubuntu0.15, 1:9.9.5.dfsg-3ubuntu0.7, 1:9.9.5.dfsg-9ubuntu0.5, 1:9.9.5.dfsg-11ubuntu1.2
bind99 - addressed in versions 9.9.8-2.P3.fc22, 9.9.8-2.P3.fc23
bind - addressed in versions 9.10.3-8.P3.fc22, 9.10.3-10.P3.fc23
Dell EMC Unisphere Central - update to 4.0.7

• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178045.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175973.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00022.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00025.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html
• http://marc.info/?l=bugtraq&m=145680832702035&w=2
• http://rhn.redhat.com/errata/RHSA-2016-0073.html
• http://rhn.redhat.com/errata/RHSA-2016-0074.html
• http://www.debian.org/security/2016/dsa-3449
• http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
• http://www.securityfocus.com/bid/81329
• http://www.securitytracker.com/id/1034739
• http://www.ubuntu.com/usn/USN-2874-1
• https://kb.isc.org/article/AA-01335
• https://kb.isc.org/article/AA-01380
• https://kb.isc.org/article/AA-01438
• https://security.gentoo.org/glsa/201610-07
• https://www.freebsd.org/security/advisories/FreeBSD-SA-16:08.bind.asc

• Input validation error in ISC BIND
• SUSE Linux update for bind
• SUSE Linux update for bind
• OpenSUSE Linux update for bind
• SUSE Linux update for bind
• SUSE Linux update for bind
• Input validation error in bind (Alpine package)
• Amazon Linux AMI update for bind
• Slackware Linux update for bind
• Multiple vulnerabilities in Dell EMC Unisphere Central
• Fedora 23 update for bind
• Fedora 22 update for bind
• Fedora 22 update for bind99
• Fedora 23 update for bind99
• Ubuntu update for bind9