Arch Linux Security Advisory ASA-201603-13 ========================================== Severity: Low Date : 2016-03-12 CVE-ID : CVE-2016-2088 CVE-2016-1286 CVE-2016-1285 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P4-1 . # pacman -Syu "bind>=9.10.3.P4-1" The problem has been fixed upstream in version 9.10.3-P4. Workaround ========== None. Description =========== - CVE-2016-2088 (denial of service) Allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option. - CVE-2016-1286 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. - CVE-2016-1285 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c Impact ====== A remote attacker is able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2088 https://access.redhat.com/security/cve/CVE-2016-1286 https://access.redhat.com/security/cve/CVE-2016-1285 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2088 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1286 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1285