BIND9 - Security Update
Summary
DLA-957-1: bind9 - security update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u16. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND9 is an open-source DNS server software package. It provides the functionality to resolve domain names to IP addresses and vice versa. BIND9 is widely used across various operating systems and is a critical component of the internet infrastructure. However, several vulnerabilities have been discovered in BIND9 that could potentially lead to denial-of-service attacks.
Vulnerability Detail
Three vulnerabilities have been identified in BIND9:
-
CVE-2017-3136: BIND9 does not handle certain queries properly when using DNS64 with the "break-dnssec yes;" option, allowing a remote attacker to cause a denial-of-service.
-
CVE-2017-3137: BIND9 makes incorrect assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records, leading to situations where BIND9 exits with an assertion failure. This can be exploited by an attacker to cause a denial-of-service.
-
CVE-2017-3138: BIND9 can exit with a REQUIRE assertion failure if it receives a null command string on its control channel. Although the fix applied in Debian is only a hardening measure, it addresses the issue to prevent potential attacks.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u16
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities.
Conclusion
BIND9 has been found to have three vulnerabilities that could potentially lead to denial-of-service attacks. It is crucial to upgrade to the latest version of bind9 to ensure the security and stability of your DNS server. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
BIND9 is an open-source DNS server software package used to resolve domain names to IP addresses and vice versa.
These vulnerabilities can potentially lead to denial-of-service attacks, causing the BIND9 service to become unresponsive or crash.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to upgrade to the latest version of bind9 to mitigate the risks.
You can find more information about these vulnerabilities in the Debian LTS security advisories. Visit https://wiki.debian.org/LTS for further details.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
