CVE-2016-1285

CWE-617 — Reachable AssertionCWE-20 — Improper Input Validation13 documents10 sources
Severity
6.8MEDIUM
EPSS
69.0%
top 1.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
ISC BindCanonical Ubuntu LinuxDebian Debian Linux+11 more
Timeline
PublishedMar 9
Latest updateMay 17

Description

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 2.2 | Impact: 4.0

Affected Packages13 packages

▶NVDisc/bind9.0.0 — 9.9.8+3
▶Debianbind9< 1:9.10.3.dfsg.P4-6+3
▶Ubuntubind9< 1:9.9.5.dfsg-3ubuntu0.8
▶NVDsuse/manager2.1
▶NVDjuniper/junos11 versions+10

Also affects: Debian Linux 7.0, 8.0, 9.0, Fedora 22, 23, 24, Ubuntu Linux 12.04, 14.04, 15.10

🔴Vulnerability Details

4
GHSA
GHSA-g4mp-qjqq-f2f5: named in ISC BIND 9↗2022-05-17
▶
OSV
CVE-2016-1285: named in ISC BIND 9↗2016-03-09
▶
OSV
bind9 vulnerabilities↗2016-03-09
▶
CVEList
CVE-2016-1285: named in ISC BIND 9↗2016-03-09
▶

📋Vendor Advisories

4
BSD
FreeBSD-SA-16:13.bind: Multiple BIND vulnerabilities↗2016-03-10
▶
Red Hat
bind: malformed packet sent to rndc can trigger assertion failure↗2016-03-09
▶
Ubuntu
Bind vulnerabilities↗2016-03-09
▶
Debian
CVE-2016-1285: bind9 - named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not prope...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 bind: various flaws [fedora-all]↗2016-03-10
▶
Bugzilla
CVE-2016-1285 CVE-2016-1286 bind99: various flaws [fedora-all]↗2016-03-10
▶
Bugzilla
CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure↗2016-03-08
▶