Denial of Service Vulnerability in ISC BIND
Summary
CVE-2016-9147: named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related... Affects bind across 5 version ranges.
< 9.10.4_p5-r0
< 67d38a63139de8be0f3a307d1f6a9ad16770edac
< 853aa4b2e04de28173429fc24780b21fadb5cef5
< 53185941dd83e11acf5ea5ebca9748987159803a
< dca6957b62013f523e54084c92152f571d08f6c0
Fixed in 9.10.4_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ISC BIND is an open-source DNS software package that provides domain name resolution services. It is widely used by organizations to manage DNS infrastructure. The vulnerability, identified as CVE-2016-9147, affects versions 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 of ISC BIND. This vulnerability allows remote attackers to cause a denial of service by exploiting an inconsistency among the DNSSEC-related RRsets in a response.
Vulnerability Detail
The vulnerability in ISC BIND allows attackers to trigger an assertion failure and force the daemon to exit, resulting in a denial of service. This can be accomplished by sending a response containing inconsistent DNSSEC-related RRsets. The impact of this vulnerability can be severe, as it disrupts the availability of DNS services, potentially affecting the resolution of domain names and causing service outages.
How To Fix
Minimum fixed version
9.10.4_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch or update to a fixed version of ISC BIND to mitigate the risk of a denial of service attack.
Conclusion
The denial of service vulnerability in ISC BIND can be mitigated by updating to a fixed version. It is crucial to apply the recommended patch or update to ensure the availability and stability of DNS services. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
ISC BIND is an open-source DNS software package used for domain name resolution.
Versions 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 of ISC BIND are affected.
Remote attackers can exploit this vulnerability by sending a response containing inconsistent DNSSEC-related RRsets.
The vulnerability can cause a denial of service by triggering an assertion failure and forcing the daemon to exit, resulting in service disruptions.
To fix this vulnerability, update ISC BIND to version 9.10.4_p5-r0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
