Arch Linux Security Advisory ASA-201704-11 ========================================== Severity: High Date : 2017-04-29 CVE-ID : CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-239 Summary ======= The package bind before version 9.11.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.1-1. # pacman -Syu "bind>=9.11.1-1" The problems have been fixed upstream in version 9.11.1. Workaround ========== None. Description =========== - CVE-2017-3136 (denial of service) A security issue has been found in bind, where an error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;". - CVE-2017-3137 (denial of service) A security issue has been found in bind, where a server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering. - CVE-2017-3138 (denial of service) A security issue has been found in the bind named daemon, that will exit with a "require" assertion failure if it receives a null command string on its control channel. The control channel is not enabled by default and is usually restricted to a few remote hosts via an ACL and/or a transaction key. Impact ====== A remote attacker can crash the application, leading to denial of service. References ========== https://deepthought.isc.org/article/AA-01471 https://deepthought.isc.org/article/AA-01465 https://deepthought.isc.org/article/AA-01466 https://security.archlinux.org/CVE-2017-3136 https://security.archlinux.org/CVE-2017-3137 https://security.archlinux.org/CVE-2017-3138