Denial of Service Vulnerability in BIND Package: CVE-2016-9131
Summary
ALPINE-CVE-2016-9131: named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE AN... Affects bind versions < 9.10.4_p5-r0. Fixed in 9.10.4_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that enables the resolution of domain names into IP addresses. It is a critical component of the internet infrastructure, providing essential services for domain name resolution. The BIND package is known for its robustness and flexibility, but it has been subject to various vulnerabilities over the years, including CVE-2016-9131, which affects multiple versions of the software.
Vulnerability Detail
CVE-2016-9131 is a vulnerability found in ISC BIND versions prior to 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2. This vulnerability allows remote attackers to exploit a malformed response to an RTYPE ANY query, leading to a denial of service condition. The result is an assertion failure that causes the BIND daemon to exit unexpectedly, disrupting DNS services and potentially affecting numerous users and applications relying on DNS resolution.
How To Fix
Minimum fixed version
9.10.4_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the DNS server by configuring firewall rules to limit incoming requests to trusted IP addresses only. This will help mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2016-9131 is a significant vulnerability in the BIND DNS server software that can lead to denial of service attacks. It is crucial for users of affected versions to update to the patched version to ensure the security and reliability of their DNS services. Implementing workarounds can provide temporary relief until a full update can be performed.
See every vulnerability recorded for bind →
FAQ
CVE-2016-9131 is a vulnerability in the BIND DNS server software that allows remote attackers to cause a denial of service by sending a malformed response to an RTYPE ANY query.
You can check if your BIND installation is affected by using the Vulert playground at Vulert Scanner, which allows you to analyze your manifest file for vulnerabilities.
The vulnerability can lead to a denial of service, causing the BIND daemon to crash and disrupt DNS services, which can impact users and applications relying on DNS.
Yes, a patch is available in the form of BIND version 9.10.4_P5-r0 or later. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update immediately, consider implementing firewall rules to restrict access to your DNS server and limit incoming requests to trusted IP addresses as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
