Summary: | <net-dns/bind-9.10.4_p3: Malicious primary DNS servers can crash secondaries (CVE-2016-6170) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | idl0r |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.openwall.com/lists/oss-security/2016/07/06/3 | ||
Whiteboard: | B3 [glsa cve] | ||
Package list: | Runtime testing required: | --- |
Description
Agostino Sarubbo
![]() CVE-2016-6170 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6170): ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message. (In reply to Christian Ruppert (idl0r) from comment #1) > https://kb.isc.org/article/AA-01390/169/CVE-2016-6170 Given ISC's review of the matter, it would probably be best that we address this with a GLSA discussing the workaround for administrators. This is an inherent flaw within the protocol specifications, but of course can be administratively controlled through the implementation. ISC is going to offer that solution soon and PowerDNS already has patches proposed. This issue was resolved and addressed in GLSA 201610-07 at https://security.gentoo.org/glsa/201610-07 by GLSA coordinator Kristian Fiskerstrand (K_F). |