SB2017011205 - Debian update for bind9
Published: January 12, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2016-9131)
The vulnerability allows a remote attacker to cause denial of service conditions.
The vulnerability exists due to assertion failure when processing DNS responses. A remote attacker can send a malformed response to an RTYPE ANY query, trigger assertion failure and cause denial of service.
Successful exploitation of the vulnerability will result in DoS attack against vulnerable application.
2) Input validation error (CVE-ID: CVE-2016-9147)
The vulnerability allows a remote attacker to cause denial of service conditions.
The vulnerability exists due to assertion failure when processing input data. A remote attacker can send a response containing an inconsistency among the DNSSEC-related RRsets, trigger assertion failure and cause denial of service.
Successful exploitation of the vulnerability will result in DoS attack against vulnerable application.
3) Input validation error (CVE-ID: CVE-2016-9444)
The vulnerability allows a remote attacker to cause denial of service conditions.
The vulnerability exists due to assertion failure when processing input data. A remote attacker can send a specially crafted DS resource record in an answer, trigger assertion failure and cause denial of service.
Successful exploitation of the vulnerability will result in DoS attack against vulnerable application.
Remediation
Install update from vendor's website.