Denial of service vulnerability in BIND



| Updated: 2016-07-11
Risk Low
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2016-6170
CWE-ID CWE-233
Exploitation vector Network
Public exploit N/A
Vulnerable software
 ISC BIND
Server applications / DNS servers

Vendor ISC

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) AXFR/IXFR response processing flaw in BIND

EUVDB-ID: #VU103

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-6170

CWE-ID: CWE-233 - Improper Handling of Parameters

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause the target service to crash.

The vulnerability exists due to resource error in BIND. A remote primary DNS server can cause the target secondary DNS server to crash by sending a specially crafted AXFR response or IXFR response. A remote unauthenticated attacker may be able to send a specially crafted UPDATE message to cause the target server to crash.

Successful exploitation of this vulnerability may result in denial of service.

Mitigation

Cybersecurity Help is currently unaware of any official solution, which resolves this vulnerability.

A third-party unofficial patch is available at: https://github.com/sischkg/xfer-limit.

Vulnerable software versions

ISC BIND: 9.9.9-P1 - 9.10.4-P1

CPE2.3 External links

https://kb.isc.org/article/AA-01390


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###