Denial of Service Vulnerability in BIND Package - CVE-2016-9444
Summary
ALPINE-CVE-2016-9444: named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an... Affects bind versions < 9.10.4_p5-r0. Fixed in 9.10.4_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a range of functionalities including domain name resolution and DNS management. It is known for its robustness and flexibility, making it a popular choice for both small and large-scale deployments. However, BIND has been found to be vulnerable to certain security issues, including CVE-2016-9444, which can lead to denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2016-9444 affects named in ISC BIND versions prior to 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2. It allows remote attackers to exploit a crafted DS resource record in an answer, leading to an assertion failure and subsequent daemon exit. This can result in a denial of service, making the DNS service unavailable to legitimate users. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.10.4_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing firewall rules to restrict access to the DNS service, thereby mitigating the risk of exploitation until the package can be updated.
Conclusion
CVE-2016-9444 is a significant vulnerability affecting the BIND DNS server software, allowing for potential denial of service attacks. It is crucial for users to update their installations to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bind →
FAQ
CVE-2016-9444 is a vulnerability in the BIND DNS server software that allows remote attackers to cause a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, making the DNS service unavailable to users.
Yes, the patched version of BIND is 9.10.4_p5-r0 and later versions. Updating to this version will resolve the vulnerability.
Implement firewall rules to restrict access to the DNS service as a temporary workaround until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
