OpenSUSE Linux update for bind
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Denial of service
EUVDB-ID: #VU164
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2016-2775
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause the target service to crash.
The vulnerability exists due to boundary error in BIND. A remote unauthenticated attacker can cause the target BIND server to crash by sending a specially crafted request with a query name and a search list entry that exceeds the maximum allowable length.
Systems using the lightweight resolution protocol via either the 'lwresd' utility or via named using the "lwres" statement in 'named.conf' are affected.
Successful exploitation of this vulnerability may result in denial of service.
Update the affected packages.
Opensuse: 42.1 - 42.2
CPE2.3 External linkshttps://lists.opensuse.org/opensuse-security-announce/2017-04/msg00022.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) AXFR/IXFR response processing flaw in BIND
EUVDB-ID: #VU103
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-6170
CWE-ID:
CWE-233 - Improper Handling of Parameters
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause the target service to crash.
The vulnerability exists due to resource error in BIND. A remote primary DNS server can cause the target secondary DNS server to crash by sending a specially crafted AXFR response or IXFR response. A remote unauthenticated attacker may be able to send a specially crafted UPDATE message to cause the target server to crash.
Successful exploitation of this vulnerability may result in denial of service.
MitigationUpdate the affected packages.
Opensuse: 42.1 - 42.2
CPE2.3 External linkshttps://lists.opensuse.org/opensuse-security-announce/2017-04/msg00022.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Assertion failure
EUVDB-ID: #VU16152
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-3136
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the servers are configured to use DNS64 and if the option "break-dnssec yes;" is in use. A remote attacker can supply specially crafted queries, if it was configured to use the DNS64 feature and other preconditions were met, trigger a server using DNS64 assertion failure and cause the service to crash.
MitigationUpdate the affected packages.
Opensuse: 42.1 - 42.2
CPE2.3 External linkshttps://lists.opensuse.org/opensuse-security-announce/2017-04/msg00022.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Assertion failure
EUVDB-ID: #VU7227
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-3137
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing query response containing CNAME or DNAME resource records in an unusual order in BIND. A remote attacker can trigger assertion failure and crash BIND application.
Update the affected packages.
Opensuse: 42.1 - 42.2
CPE2.3 External linkshttps://lists.opensuse.org/opensuse-security-announce/2017-04/msg00022.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Assertion failure
EUVDB-ID: #VU16151
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-3138
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.. A remote attacker can send some versions of named a null command string, trigger a REQUIRE assertion failure and cause the service to crash.
Update the affected packages.
Opensuse: 42.1 - 42.2
CPE2.3 External linkshttps://lists.opensuse.org/opensuse-security-announce/2017-04/msg00022.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
