CVE-2016-1286

CWE-617 — Reachable AssertionCWE-20 — Improper Input ValidationCWE-128614 documents10 sources
Severity
8.6HIGH
EPSS
53.6%
top 2.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
ISC BindCanonical Ubuntu LinuxDebian Debian Linux+11 more
Timeline
PublishedMar 9
Latest updateMay 17

Description

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages13 packages

▶NVDisc/bind9.0.0 — 9.9.8+3
▶Debianbind9< 1:9.10.3.dfsg.P4-6+3
▶Ubuntubind9< 1:9.9.5.dfsg-3ubuntu0.8
▶NVDsuse/manager2.1
▶NVDjuniper/junos11 versions+10

Also affects: Debian Linux 7.0, 8.0, 9.0, Fedora 22, 23, 24, Ubuntu Linux 12.04, 14.04, 15.10

🔴Vulnerability Details

4
GHSA
GHSA-jj28-4744-gvh3: named in ISC BIND 9↗2022-05-17
▶
OSV
CVE-2016-1286: named in ISC BIND 9↗2016-03-09
▶
OSV
bind9 vulnerabilities↗2016-03-09
▶
CVEList
CVE-2016-1286: named in ISC BIND 9↗2016-03-09
▶

📋Vendor Advisories

5
Red Hat
spice: Remote DoS via crafted message↗2017-02-06
▶
BSD
FreeBSD-SA-16:13.bind: Multiple BIND vulnerabilities↗2016-03-10
▶
Red Hat
bind: malformed signature records for DNAME records can trigger assertion failure↗2016-03-09
▶
Ubuntu
Bind vulnerabilities↗2016-03-09
▶
Debian
CVE-2016-1286: bind9 - named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote ...↗2016
▶

🕵️Threat Intelligence

1
Fortinet
Internet In Danger: Analysis of ISC Bind Patch (part 2)↗2016-04-01
▶

💬Community

3
Bugzilla
CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 bind: various flaws [fedora-all]↗2016-03-10
▶
Bugzilla
CVE-2016-1285 CVE-2016-1286 bind99: various flaws [fedora-all]↗2016-03-10
▶
Bugzilla
CVE-2016-1286 bind: malformed signature records for DNAME records can trigger assertion failure↗2016-03-08
▶