Vulnerability in bind9 - Denial-of-Service
Summary
DLA-805-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u14. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bind9 is a DNS server implementation used for resolving domain names to IP addresses. It provides recursive service for DNS queries and is commonly used in various systems. However, bind9 is vulnerable to several denial-of-service vulnerabilities that can be triggered by specially-crafted upstream responses.
Vulnerability Detail
The vulnerability, identified as CVE-2016-9131, CVE-2016-9147, and CVE-2016-9444, allows an attacker to cause assertion failures in bind9. These vulnerabilities primarily affect DNS servers providing recursive service. Crafted upstream responses with certain characteristics can lead to assertion failures, regardless of whether DNSSEC validation is enabled or not. The impact of these vulnerabilities is limited to the availability of the DNS service and does not directly lead to remote code execution or unauthorized access.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for these vulnerabilities. It is essential to apply the provided fix by upgrading the bind9 package to the patched version.
Conclusion
In conclusion, bind9 is susceptible to denial-of-service vulnerabilities that can be exploited by specially-crafted upstream responses. To mitigate these vulnerabilities, it is crucial to upgrade the bind9 package to the patched version. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
bind9 is a DNS server implementation used for resolving domain names to IP addresses.
The vulnerabilities can cause denial-of-service by triggering assertion failures in bind9, affecting the availability of the DNS service.
No, these vulnerabilities do not directly lead to remote code execution or unauthorized access.
No, these vulnerabilities predominantly affect DNS servers providing recursive service. Client queries to authoritative-only servers cannot trigger these assertion failures.
These vulnerabilities are present whether or not DNSSEC validation is enabled in the server configuration.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
