bind9 - Security Update
Summary
DLA-645-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u11. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bind9 is a DNS (Domain Name System) server software package. It provides the functionality to resolve domain names into IP addresses and vice versa. This vulnerability affects bind9 in Debian 7 Wheezy. The package version 1:9.8.4.dfsg.P1-6+nmu2+deb7u11 is impacted.
Vulnerability Detail
The vulnerability, identified as CVE-2016-2775, is a crash issue in the lwresd component of bind9. It occurs when a long query name is processed, leading to a crash of the lwresd service. The vulnerability has been fixed with the backport of upstream commit 38cc2d14e218e536e0102fa70deef99461354232. Another vulnerability, CVE-2016-2776, is an assertion failure caused by a crafted query. The fix for this vulnerability is based on the patch 43139-9-9.patch from ISC. These vulnerabilities can potentially be exploited by attackers to disrupt the DNS service or execute arbitrary code on the affected system.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, bind9 in Debian 7 Wheezy is affected by two vulnerabilities (CVE-2016-2775 and CVE-2016-2776) that can lead to crashes and assertion failures. It is crucial to upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u11 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
bind9 is a DNS server software package that provides domain name resolution functionality.
The vulnerabilities impact bind9 version 1:9.8.4.dfsg.P1-6+nmu2+deb7u11 in Debian 7 Wheezy.
The vulnerabilities can lead to crashes of the lwresd service and assertion failures. They may also allow attackers to disrupt the DNS service or execute arbitrary code on the affected system.
To fix the vulnerabilities, it is recommended to upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u11 or later.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
