Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 589132 (CVE-2016-2775) - <net-dns/bind-{,tools}-9.10.4_p2: potential denial-of-service attack against lwres functionality in BIND (CVE-2016-2775)
Summary: <net-dns/bind-{,tools}-9.10.4_p2: potential denial-of-service attack against ...
Alias: CVE-2016-2775
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [glsa cve]
Depends on:
Reported: 2016-07-19 07:37 UTC by Agostino Sarubbo
Modified: 2016-10-11 18:55 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-07-19 07:37:04 UTC
From ${URL} :

Earlier today ISC disclosed a vulnerability affecting BIND (specifically
affecting lightweight resolution functionality in BIND, NOT normal DNS
resolution.  The bug affects the lwresd program or named if is configured
to do lightweight resolution using the "lwres" configuration statement.)

The defect was publicly disclosed as CVE-2016-2775 and the official
vulnerability disclosure is here:

Ordinarily we try to give advance notice to packagers when we are
preparing new releases of BIND.  Unfortunately our timetable for this
incident changed in mid-course when the reporting party informed us
that reproduction code was already available in a public bug repository.

We apologize for the inconvenience caused by the acceleration of our
disclosure timetable.

New releases of BIND are available which fix the lwres issue
(CVE-2016-2775) and include fixes for a few regressions which
had been introduced in recent versions.  You can find them in
the usual place on our site:

A standalone patch diff addressing only CVE-2016-2775 can be made
available upon request to any parties who want only the lwres CVE
fix and not the other regression fixes.  Contact
if you wish to request it.

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2016-07-30 01:09:04 UTC
CVE-2016-2775 (
  ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before
  9.11.0b2, when lwresd or the named lwres option is enabled, allows remote
  attackers to cause a denial of service (daemon crash) via a long request
  that uses the lightweight resolver protocol.
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-07-30 01:17:08 UTC
fixed version is already in tree.

@maintainer(s), ready to stable?
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2016-09-26 04:53:27 UTC
Ping on Stabilization?
Comment 4 Christian Ruppert (idl0r) gentoo-dev 2016-09-28 19:13:42 UTC
See also #595340
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2016-10-11 18:55:47 UTC
This issue was resolved and addressed in
 GLSA 201610-07 at
by GLSA coordinator Kristian Fiskerstrand (K_F).