Security Update for bind9 Package
Summary
DLA-672-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u12. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bind9 package is a DNS server implementation that provides domain name resolution services. It is widely used in authoritative and recursive DNS servers. This package is vulnerable to a defect, identified as CVE-2016-2848, which can cause the server to exit with an assertion failure when it receives a malformed packet.
Vulnerability Detail
The vulnerability, CVE-2016-2848, affects both authoritative and recursive servers running bind9. An attacker can exploit this vulnerability by sending a specially crafted packet to the server, causing it to exit unexpectedly. This can lead to a denial of service (DoS) condition, impacting the availability of DNS services. The vulnerability has been fixed in bind9 version 1:9.8.4.dfsg.P1-6+nmu2+deb7u12.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The bind9 package is vulnerable to a defect that can cause a denial of service (DoS) condition. It is recommended to upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u12 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
bind9 is a DNS server implementation that provides domain name resolution services.
The vulnerability can lead to a denial of service (DoS) condition, affecting the availability of DNS services.
Users running bind9 authoritative or recursive servers on Debian 7 Wheezy are affected by this vulnerability.
Yes, the vulnerability has been fixed in bind9 version 1:9.8.4.dfsg.P1-6+nmu2+deb7u12.
To upgrade the bind9 package, you can use the package manager command specific to your operating system. For Debian 7 Wheezy, the command would be: sudo apt-get update && sudo apt-get install bind9
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
