Arch Linux Security Advisory ASA-201611-3 ========================================= Severity: High Date : 2016-11-01 CVE-ID : CVE-2016-8864 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.11.0.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.0.P1-1. # pacman -Syu "bind>=9.11.0.P1-1" The problem has been fixed upstream in version 9.11.0.P1. Workaround ========== None. Description =========== A defect in BIND's handling of responses containing a DNAME answer can cause a resolver to exit after encountering an assertion failure in db.c or resolver.c During processing of a recursive response that contains a DNAME record in the answer section, BIND can stop execution after encountering an assertion error in resolver.c (error message: "INSIST((valoptions & 0x0002U) != 0) failed") or db.c (error message: "REQUIRE(targetp != ((void *)0) && *targetp == ((void *)0)) failed"). A server encountering either of these error conditions will stop, resulting in denial of service to clients. The risk to authoritative servers is minimal; recursive servers are chiefly at risk. Impact ====== An attacker can send a crafted DNAME answer to crash the application. References ========== https://kb.isc.org/article/AA-01434/0 https://ftp.isc.org/isc/bind9/9.11.0-P1/RELEASE-NOTES-bind-9.11.0-P1.html https://access.redhat.com/security/cve/CVE-2016-8864