#VU31953 Input validation error in ISC BIND - CVE-2015-8705

Vulnerability identifier: #VU31953

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-8705

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ISC BIND
Server applications / DNS servers

Vendor: ISC

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.

Mitigation
Install update from vendor's website.

Vulnerable software versions

ISC BIND: 9.9.8-P3

---

External links
https://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html
https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html
https://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
https://www.securityfocus.com/bid/81314
https://www.securitytracker.com/id/1034740
https://kb.isc.org/article/AA-01336
https://kb.isc.org/article/AA-01380
https://security.gentoo.org/glsa/201610-07

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.