From ${URL} : Earlier today ISC disclosed a vulnerability affecting BIND (specifically affecting lightweight resolution functionality in BIND, NOT normal DNS resolution. The bug affects the lwresd program or named if is configured to do lightweight resolution using the "lwres" configuration statement.) The defect was publicly disclosed as CVE-2016-2775 and the official vulnerability disclosure is here: https://kb.isc.org/article/AA-01393/74/CVE-2016-2775 Ordinarily we try to give advance notice to packagers when we are preparing new releases of BIND. Unfortunately our timetable for this incident changed in mid-course when the reporting party informed us that reproduction code was already available in a public bug repository. We apologize for the inconvenience caused by the acceleration of our disclosure timetable. New releases of BIND are available which fix the lwres issue (CVE-2016-2775) and include fixes for a few regressions which had been introduced in recent versions. You can find them in the usual place on our site: https://www.isc.org/downloads A standalone patch diff addressing only CVE-2016-2775 can be made available upon request to any parties who want only the lwres CVE fix and not the other regression fixes. Contact security-officer@isc.org if you wish to request it. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
CVE-2016-2775 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2775): ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
fixed version is already in tree. @maintainer(s), ready to stable?
Ping on Stabilization?
See also #595340
This issue was resolved and addressed in GLSA 201610-07 at https://security.gentoo.org/glsa/201610-07 by GLSA coordinator Kristian Fiskerstrand (K_F).