Vulnerability in bind9 - security update
Summary
DLA-285-1: bind9 - security update. Affects bind9 versions < 1:9.7.3.dfsg-1~squeeze16. Fixed in 1:9.7.3.dfsg-1~squeeze16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bind9 package is a DNS server implementation that provides domain name resolution services. It is widely used across various platforms and is a critical component of the internet infrastructure. The bind9 package in Debian 6.0 (Squeeze) is affected by a security vulnerability.
Vulnerability Detail
The vulnerability in bind9 (CVE-2015-5477) relates to the handling of TKEY queries. An attacker can exploit this flaw by sending a specially crafted query, triggering an assertion failure and causing the BIND DNS server to exit. This vulnerability can be exploited remotely, leading to a denial of service (DoS) attack. The impact of this vulnerability can disrupt DNS services and potentially affect the availability of websites and other network services relying on DNS resolution.
How To Fix
Minimum fixed version
1:9.7.3.dfsg-1~squeeze16
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The bind9 package in Debian 6.0 (Squeeze) is vulnerable to a denial of service (DoS) attack due to a flaw in handling TKEY queries. It is crucial to update the bind9 package to the recommended version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
bind9 is a DNS server implementation used for domain name resolution services.
The vulnerability allows remote attackers to cause a denial of service (DoS) by triggering an assertion failure and causing the BIND DNS server to exit.
To fix this vulnerability, update the bind9 package to version 1:9.7.3.dfsg-1~squeeze16 or later.
No workaround has been provided for this vulnerability.
For more information, you can refer to the official Debian security advisory DLA-285-1.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
