CVE-2016-1285
published 2016-03-09CVE-2016-1285: named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote…
PriorityP347medium6.8CVSS 3.1
AVNACHPRNUINSCCNINAH
EPSS
57.40%
99.1th percentile
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | bind9 | < bind9 1:9.10.3.dfsg.P4-6 (bookworm) | bind9 1:9.10.3.dfsg.P4-6 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | >= 9.0.0 < 9.9.8 | 9.9.8 |
| isc | bind | >= 9.10.0 < 9.10.3 | 9.10.3 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-6 | 1:9.10.3.dfsg.P4-6 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-6 | 1:9.10.3.dfsg.P4-6 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-6 | 1:9.10.3.dfsg.P4-6 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-6 | 1:9.10.3.dfsg.P4-6 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-3ubuntu0.8 | 1:9.9.5.dfsg-3ubuntu0.8 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger point is an assertion failure in sexpr.c or alist.c when a malformed packet is sent to named's rndc control channel interface — monitor for named process crashes (assertion failures) originating from these source files. ↗
- →Authentication is NOT required to exploit this vulnerability — any connection to the rndc control channel port from an unauthenticated remote source should be treated as suspicious and alerted on. ↗
- →The exploit involves crafting an rndc request that sets an incorrect type value in the isccc_sexpr structure for the _auth or _ctrl records, causing isccc_alist_alistp() to return ISC_FALSE and triggering the REQUIRE assertion in isccc_alist_assq(). Inspect rndc packets for malformed or unexpected type fields in _auth/_ctrl records. ↗
- →The vulnerability is exploitable only when the rndc control channel is accessible — detect exposure by checking if named accepts remote rndc commands (i.e., a 'controls' statement is present in named.conf allowing non-localhost connections). ↗
- ·By default, named only allows rndc control channel connections from localhost (127.0.0.1 and ::1) if rndc.key exists; the attack surface is only exposed when a 'controls' statement explicitly permits remote connections. ↗
- ·Mitigation (not a fix) is to restrict the 'controls' statement in named.conf to trusted systems only; this limits exposure but does not patch the underlying assertion failure. ↗
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
vendor_ubuntu6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
BSD
FreeBSD-SA-16:13.bind: Multiple BIND vulnerabilities
bsd_advisories·2016-03-10·CVSS 6.8
CVE-2016-1285 [MEDIUM] FreeBSD-SA-16:13.bind: Multiple BIND vulnerabilities
FreeBSD-SA-16:13.bind Security Advisory
The FreeBSD Project
Topic: Multiple BIND vulnerabilities
Category: contrib
Module: bind
Announced: 2016-03-10
Credits: ISC
Affects: FreeBSD 9.x
Corrected: 2016-03-10 07:47:55 UTC (stable/9, 9.3-STABLE)
2016-03-10 10:03:28 UTC (releng/9.3, 9.3-RELEASE-p38)
CVE Name: CVE-2016-1285, CVE-2016-1286
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.
II. Problem Description
Testing by ISC has uncovered a defect in control channel input handling
which can cause named to exit due to an assertion fai
Red Hat
bind: malformed packet sent to rndc can trigger assertion failure
vendor_redhat·2016-03-09·CVSS 6.8
CVE-2016-1285 [MEDIUM] CWE-617 bind: malformed packet sent to rndc can trigger assertion failure
bind: malformed packet sent to rndc can trigger assertion failure
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
A denial of service flaw was found in the way BIND processed certain control channel input. A remote attacker able to send a malformed packet to the control channel could use this flaw to cause named to crash.
Mitigation: Restrict access to the control channel (by using the "controls" configuration statement in named.conf) to allow connection only from trusted systems.
Note that if no "control
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2016-03-09·CVSS 6.8
CVE-2016-1285 [MEDIUM] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Bind could be made to crash if it received specially crafted network
traffic.
It was discovered that Bind incorrectly handled input received by the rndc
control channel. A remote attacker could possibly use this issue to cause
Bind to crash, resulting in a denial of service. (CVE-2016-1285)
It was discovered that Bind incorrectly parsed resource record signatures
for DNAME resource records. A remote attacker could possibly use this issue
to cause Bind to crash, resulting in a denial of service. (CVE-2016-1286)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2016-1285: bind9 - named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not prope...
vendor_debian·2016·CVSS 6.8
CVE-2016-1285 [MEDIUM] CVE-2016-1285: bind9 - named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not prope...
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
Scope: local
bookworm: resolved (fixed in 1:9.10.3.dfsg.P4-6)
bullseye: resolved (fixed in 1:9.10.3.dfsg.P4-6)
forky: resolved (fixed in 1:9.10.3.dfsg.P4-6)
sid: resolved (fixed in 1:9.10.3.dfsg.P4-6)
trixie: resolved (fixed in 1:9.10.3.dfsg.P4-6)
GHSA
GHSA-g4mp-qjqq-f2f5: named in ISC BIND 9
ghsa_unreviewed·2022-05-17
CVE-2016-1285 [MEDIUM] CWE-20 GHSA-g4mp-qjqq-f2f5: named in ISC BIND 9
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
OSV
CVE-2016-1285: named in ISC BIND 9
osv·2016-03-09·CVSS 6.8
CVE-2016-1285 [MEDIUM] CVE-2016-1285: named in ISC BIND 9
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
OSV
bind9 vulnerabilities
osv·2016-03-09·CVSS 6.8
CVE-2016-1285 [MEDIUM] bind9 vulnerabilities
bind9 vulnerabilities
It was discovered that Bind incorrectly handled input received by the rndc
control channel. A remote attacker could possibly use this issue to cause
Bind to crash, resulting in a denial of service. (CVE-2016-1285)
It was discovered that Bind incorrectly parsed resource record signatures
for DNAME resource records. A remote attacker could possibly use this issue
to cause Bind to crash, resulting in a denial of service. (CVE-2016-1286)
No detection rules found.
No public exploits indexed.
Checkpoint
8th March – Threat Intelligence Report
blogs_checkpoint·2021-03-08
CVE-2021-1285 8th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 8th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 8th March, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
SITA, a communications and IT vendor for 90 percent of the world’s airlines, has been breached in a massive supply-chain attack, compromising frequent-flyer data across many carriers such as United, Singapore Airlines, Lufthansa, and more.
Spirit Airlines has suffered a data breach by “Nefilim” ransomware. A first batch of cus
Fortinet
Internet In Danger: Analysis of ISC Bind Patch (part 1)
blogs_fortinet·2016-03-29·CVSS 6.8
[MEDIUM] Internet In Danger: Analysis of ISC Bind Patch (part 1)
FORTIGUARD LABS THREAT RESEARCH
Internet In Danger: Analysis of ISC Bind Patch (part 1)
By Dehui Yin | March 29, 2016
The Internet Systems Consortium just released a couple of days ago a new patch (version 9.10.3-P4) to fix some issues in the most popular DNS server software in the world.
The release note is available at https://kb.isc.org/article/AA-01363/81/BIND-9.10.3-P4-Release-Notes.html
In this series of two articles, we will detail our investigation of these vulnerabilities and how we were able to protect our customers by deploying widely our detection.
ISC released a patch for the BIND rndc control channel DoS vulnerability (CVE-2016-1285). According to ISC, this vulnerability is due to an assertion failure in the application called named when it’s handling a malformed packet
Bugzilla
CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 bind: various flaws [fedora-all]
bugzilla·2016-03-10·CVSS 6.8
CVE-2016-1285 [MEDIUM] CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 bind: various flaws [fedora-all]
CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 bind: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fed
Bugzilla
CVE-2016-1285 CVE-2016-1286 bind99: various flaws [fedora-all]
bugzilla·2016-03-10·CVSS 6.8
CVE-2016-1285 [MEDIUM] CVE-2016-1285 CVE-2016-1286 bind99: various flaws [fedora-all]
CVE-2016-1285 CVE-2016-1286 bind99: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While o
Bugzilla
CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
bugzilla·2016-03-08·CVSS 6.8
CVE-2016-1285 [MEDIUM] CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
The following flaw, reported by ISC, was found in BIND:
Testing by ISC has uncovered a defect in control channel input handling which can cause named to exit due to an assertion failure in sexpr.c or alist.c when a malformed packet is sent to named's control channel (the interface which allows named to be controlled using the 'rndc" server control utility).
This assertion occurs before authentication but after network-address-based access controls have been applied. Or in other words: an attacker does not need to have a key or other authentication, but does need to be within the address list specified in the "controls" statement in named.conf which enables the control channel. If no "controls" statement is p
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181036.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/181037.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/178831.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/178880.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179904.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179911.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00053.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00070.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00072.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00075.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00079.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00084.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00013.htmlhttp://marc.info/?l=bugtraq&m=146191105921542&w=2http://rhn.redhat.com/errata/RHSA-2016-0562.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0601.htmlhttp://www.debian.org/security/2016/dsa-3511http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.securitytracker.com/id/1035236http://www.ubuntu.com/usn/USN-2925-1https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05087821https://kb.isc.org/article/AA-01352https://kb.isc.org/article/AA-01380https://kb.isc.org/article/AA-01438https://security.FreeBSD.org/advisories/FreeBSD-SA-16:13.bind.aschttps://security.gentoo.org/glsa/201610-07http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181036.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/181037.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/178831.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/178880.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179904.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179911.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00053.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00070.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00072.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00075.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00079.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00084.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00013.htmlhttp://marc.info/?l=bugtraq&m=146191105921542&w=2http://rhn.redhat.com/errata/RHSA-2016-0562.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0601.htmlhttp://www.debian.org/security/2016/dsa-3511http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.securitytracker.com/id/1035236http://www.ubuntu.com/usn/USN-2925-1https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05087821https://kb.isc.org/article/AA-01352https://kb.isc.org/article/AA-01380https://kb.isc.org/article/AA-01438https://security.FreeBSD.org/advisories/FreeBSD-SA-16:13.bind.aschttps://security.gentoo.org/glsa/201610-07
2016-03-09
Published