[arch-security] [ASA-201611-3] bind: denial of service
santiago at archlinux.org
Tue Nov 1 20:53:01 UTC 2016
Arch Linux Security Advisory ASA-201611-3
Date : 2016-11-01
CVE-ID : CVE-2016-8864
Package : bind
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package bind before version 9.11.0.P1-1 is vulnerable to denial of
Upgrade to 9.11.0.P1-1.
# pacman -Syu "bind>=9.11.0.P1-1"
The problem has been fixed upstream in version 9.11.0.P1.
A defect in BIND's handling of responses containing a DNAME answer can
cause a resolver to exit after encountering an assertion failure in
db.c or resolver.c
During processing of a recursive response that contains a DNAME record
in the answer section, BIND can stop execution after encountering an
assertion error in resolver.c (error message: "INSIST((valoptions &
0x0002U) != 0) failed") or db.c (error message: "REQUIRE(targetp !=
((void *)0) && *targetp == ((void *)0)) failed").
A server encountering either of these error conditions will stop,
resulting in denial of service to clients. The risk to authoritative
servers is minimal; recursive servers are chiefly at risk.
An attacker can send a crafted DNAME answer to crash the application.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: not available
More information about the arch-security