Assertion failure in ISC BIND - CVE-2015-8000

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU3848

Assertion failure in ISC BIND - CVE-2015-8000

Published: July 1, 2016 / Updated: May 17, 2017


Vulnerability identifier: #VU3848
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8000
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

A remote attacker can trigger denial of service (DoS) conditions.

The vulnerability exists due to a parsing error when processing incoming responses within db.c file. A remote attacker who can cause a server to request a record with a malformed class attribute can use this bug to trigger a REQUIRE assertion, causing named to exit and denying service to clients.

Successful exploitation of this vulnerability may allow an attacker to perform a denial of service (DoS) attack.

Affected software

ISC BIND
Amazon Linux AMI
Arch Linux
Debian Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Ubuntu
Slackware Linux
Fedora
bind (Alpine package)
bind (Red Hat package) main
dnsperf
dhcp
bind-dyndb-ldap
bind99
bind
Dell EMC Unisphere Central

How to mitigate CVE-2015-8000

Update to version 9.9.8-P2, 9.10.3-P2 or 9.9.8-S3.

bind (Alpine package) - update to 9.10.3_p2-r0
dnsperf - addressed in versions 2.0.0.0-19.fc22, 2.0.0.0-19.fc23
Dell EMC Unisphere Central - update to 4.0.7
dhcp - addressed in versions 4.3.2-6.fc22, 4.3.3-7.fc23
bind-dyndb-ldap - addressed in versions 7.0-6.fc22, 8.0-4.fc23
bind99 - addressed in versions 9.9.8-1.P2.fc22, 9.9.8-1.P2.fc23
bind - addressed in versions 9.10.3-7.P2.fc22, 9.10.3-7.P2.fc23

External References

Related Security Bulletins