CVE-2016-8864
published 2016-11-02CVE-2016-8864: named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion…
PriorityP351high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
38.73%
98.4th percentile
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bind9 | < bind9 1:9.10.3.dfsg.P4-11 (bookworm) | bind9 1:9.10.3.dfsg.P4-11 (bookworm) |
| debian | debian_linux | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | >= 9.0.0 < 9.9.9 | 9.9.9 |
| isc | bind | >= 9.10.0 < 9.10.4 | 9.10.4 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-11 | 1:9.10.3.dfsg.P4-11 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-11 | 1:9.10.3.dfsg.P4-11 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-11 | 1:9.10.3.dfsg.P4-11 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-11 | 1:9.10.3.dfsg.P4-11 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: a DNAME record in the answer section of a recursive DNS response causes an assertion failure in resolver.c or db.c, crashing named. Detection should focus on DNS responses containing DNAME records in the ANSWER section directed at recursive resolvers. ↗
- →The vulnerability is exploitable regardless of whether dnssec-validation is enabled or disabled — both code paths lead to assertion failure (valcreate() when enabled, dns_db_attach() when disabled). Detection logic should not be conditioned on DNSSEC configuration. ↗
- →No authentication is required to exploit this vulnerability; any remote attacker able to send a crafted DNS response to a recursive resolver can trigger the crash. ↗
- →Only recursive BIND servers are affected; authoritative-only servers are not at risk. Scope detection/monitoring to recursive resolvers. ↗
- →Fortinet IPS signature ISC.BIND.DNAME.answer.Response.Handling.DoS can be used to detect exploitation attempts against CVE-2016-8864. ↗
- →The assertion failure in dns_db_attach() (db.c) is triggered when the function is called a second time with a non-NULL *targetp, caused by caching a DNAME record after another record with a different name field in the ANSWER section. ↗
- →The assertion failure in valcreate() (resolver.c) is triggered when fctx->validators is non-empty and valoptions is NULL on the second call, which occurs when a DNAME record with a different name field is cached after another record in the ANSWER section with dnssec-validation enabled. ↗
- ·Affected versions are ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1. Detection/patching should verify the running BIND version falls within these ranges. ↗
- ·FreeBSD 9.x (specifically 9.3-RELEASE) ships with a vulnerable BIND version; the fix was applied in 9.3-RELEASE-p50 (corrected 2016-11-02). Systems running FreeBSD 9.x with BIND should be patched or updated. ↗
- ·Red Hat Enterprise Linux 4 ships a vulnerable bind package but the status is 'Will not fix', meaning patching via RHEL channels is not available for that platform. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xgmw-gxmf-fm4w: named in ISC BIND 9
ghsa_unreviewed·2022-05-13
CVE-2016-8864 [HIGH] CWE-617 GHSA-xgmw-gxmf-fm4w: named in ISC BIND 9
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
OSV
CVE-2016-8864: named in ISC BIND 9
osv·2016-11-02·CVSS 7.5
CVE-2016-8864 [HIGH] CVE-2016-8864: named in ISC BIND 9
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
BSD
FreeBSD-SA-16:34.bind: BIND Remote Denial of Service vulnerability
bsd_advisories·2016-11-02·CVSS 7.5
CVE-2016-8864 [HIGH] FreeBSD-SA-16:34.bind: BIND Remote Denial of Service vulnerability
FreeBSD-SA-16:34.bind Security Advisory
The FreeBSD Project
Topic: BIND Remote Denial of Service vulnerability
Category: contrib
Module: bind
Announced: 2016-11-02
Credits: ISC
Affects: FreeBSD 9.x
Corrected: 2016-11-02 05:13:27 UTC (stable/9, 9.3-STABLE)
2016-11-02 07:24:34 UTC (releng/9.3, 9.3-RELEASE-p50)
CVE Name: CVE-2016-8864
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.
II. Problem Description
A defect in BIND's handling of responses containing a DNAME answer could
cause a resolver to exit after encountering an assert
Red Hat
bind: assertion failure while handling responses containing a DNAME answer
vendor_redhat·2016-11-01·CVSS 7.5
CVE-2016-8864 [HIGH] bind: assertion failure while handling responses containing a DNAME answer
bind: assertion failure while handling responses containing a DNAME answer
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.
Package: bind (Red Hat Enterprise Linux 4) - Will not fix
Ubuntu
Bind vulnerability
vendor_ubuntu·2016-11-01
CVE-2016-8864 Bind vulnerability
Title: Bind vulnerability
Summary: Bind could be made to crash if it received specially crafted network
traffic.
Tony Finch and Marco Davids discovered that Bind incorrectly handled
certain responses containing a DNAME answer. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2016-8864: bind9 - named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x befor...
vendor_debian·2016·CVSS 7.5
CVE-2016-8864 [HIGH] CVE-2016-8864: bind9 - named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x befor...
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
Scope: local
bookworm: resolved (fixed in 1:9.10.3.dfsg.P4-11)
bullseye: resolved (fixed in 1:9.10.3.dfsg.P4-11)
forky: resolved (fixed in 1:9.10.3.dfsg.P4-11)
sid: resolved (fixed in 1:9.10.3.dfsg.P4-11)
trixie: resolved (fixed in 1:9.10.3.dfsg.P4-11)
No detection rules found.
No public exploits indexed.
Fortinet
Analysis of ISC BIND TKEY Query Response Handling DoS (CVE-2016-9131)
blogs_fortinet·2017-01-18·CVSS 7.5
CVE-2016-9131 [HIGH] Analysis of ISC BIND TKEY Query Response Handling DoS (CVE-2016-9131)
FORTIGUARD LABS THREAT RESEARCH
Analysis of ISC BIND TKEY Query Response Handling DoS (CVE-2016-9131)
By Dehui Yin | January 18, 2017
Another TKEY record-related bug in BIND has been fixed with a patch from the Internet Systems Consortium (ISC) that was released just after the New Year. This bug may take down BIND recursive servers by sending a simple query response with TKEY record, thereby causing a denial of service (DoS).
This potential DoS vulnerability is caused by an assertion failure in Resolver.c when caching the DNS response with TKEY Record. In this post we will analyze the BIND source codes and expose the root cause of this vulnerability.
The TKEY record (record type 249) is used to operate the secret keys information shared between DNS resolvers and servers. It is not supp
Fortinet
Analysis of ISC BIND DNAME Answer Handling DoS (CVE-2016-8864)
blogs_fortinet·2016-11-08·CVSS 7.5
CVE-2016-8864 [HIGH] Analysis of ISC BIND DNAME Answer Handling DoS (CVE-2016-8864)
FORTIGUARD LABS THREAT RESEARCH
Analysis of ISC BIND DNAME Answer Handling DoS (CVE-2016-8864)
By Dehui Yin | November 08, 2016
Adefect in BIND's handling of a DNAME answer was fixed in a critical update from the Internet Systems Consortium (ISC) several days ago. This defect affects all BIND recursive servers, and can be exploited to remotely take down recursive servers by sending a simple DNAME answer thereby causing a denial of service (DoS.)
This potential DoS vulnerability is caused by an assertion failure in Resolver.c or Db.c when caching the DNS response with DNAME Record. In this post we will examine the underlying code and expose the root cause of this vulnerability.
The DNAME record is used to redirect a DNS name to another domain. It has the following format:
DNAME
The DN
Fortinet
Internet In Danger: Analysis of ISC Bind Patch (part 2)
blogs_fortinet·2016-04-01·CVSS 8.6
CVE-2016-1286 [HIGH] Internet In Danger: Analysis of ISC Bind Patch (part 2)
FORTIGUARD LABS THREAT RESEARCH
Internet In Danger: Analysis of ISC Bind Patch (part 2)
By Amir Zali | April 01, 2016
In this second part article, we analyze two recent vulnerabilities in ISC BIND identified as CVE-2016-1286 and CVE-2016-2088. Based on advisories, these bugs can be triggered using a malformed DNAME record (CVE-2016-1286) or an OPT COOKIE records (CVE-2016-2088).
These two bugs share the same attack scenario that can only be triggered when a BIND server makes a request and then receives a malformed response. Based on this requirement, recursive servers are at highest risk to this attack, because it’s not straightforward to ask an authoritative-only server to make a DNS request.
CVE-2016-1286[1]
Named is a service daemon and part of the BIND application package. Named t
Fortinet
Internet In Danger: Analysis of ISC Bind Patch (part 1)
blogs_fortinet·2016-03-29·CVSS 6.8
[MEDIUM] Internet In Danger: Analysis of ISC Bind Patch (part 1)
FORTIGUARD LABS THREAT RESEARCH
Internet In Danger: Analysis of ISC Bind Patch (part 1)
By Dehui Yin | March 29, 2016
The Internet Systems Consortium just released a couple of days ago a new patch (version 9.10.3-P4) to fix some issues in the most popular DNS server software in the world.
The release note is available at https://kb.isc.org/article/AA-01363/81/BIND-9.10.3-P4-Release-Notes.html
In this series of two articles, we will detail our investigation of these vulnerabilities and how we were able to protect our customers by deploying widely our detection.
ISC released a patch for the BIND rndc control channel DoS vulnerability (CVE-2016-1285). According to ISC, this vulnerability is due to an assertion failure in the application called named when it’s handling a malformed packet
Bugzilla
CVE-2017-3135 bind99: bind: Assertion failure when using DNS64 and RPZ Can Lead to Crash [fedora-all]
bugzilla·2017-02-09·CVSS 7.5
CVE-2017-3135 [HIGH] CVE-2017-3135 bind99: bind: Assertion failure when using DNS64 and RPZ Can Lead to Crash [fedora-all]
CVE-2017-3135 bind99: bind: Assertion failure when using DNS64 and RPZ Can Lead to Crash [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
Bugzilla
CVE-2016-8864 bind99: bind: assertion failure while handling responses containing a DNAME answer [fedora-all]
bugzilla·2016-11-03·CVSS 7.5
CVE-2016-8864 [HIGH] CVE-2016-8864 bind99: bind: assertion failure while handling responses containing a DNAME answer [fedora-all]
CVE-2016-8864 bind99: bind: assertion failure while handling responses containing a DNAME answer [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2016-8864 bind: assertion failure while handling responses containing a DNAME answer [fedora-all]
bugzilla·2016-11-03·CVSS 7.5
CVE-2016-8864 [HIGH] CVE-2016-8864 bind: assertion failure while handling responses containing a DNAME answer [fedora-all]
CVE-2016-8864 bind: assertion failure while handling responses containing a DNAME answer [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
Bugzilla
CVE-2016-8864 bind: assertion failure while handling responses containing a DNAME answer
bugzilla·2016-10-28·CVSS 7.5
CVE-2016-8864 [HIGH] CVE-2016-8864 bind: assertion failure while handling responses containing a DNAME answer
CVE-2016-8864 bind: assertion failure while handling responses containing a DNAME answer
A defect in BIND's handling of responses containing a DNAME answer
can cause a resolver to exit after encountering an assertion failure
in db.c or resolver.c
During processing of a recursive response that contains a DNAME
record in the answer section, BIND can stop execution after
encountering an assertion error in resolver.c (error message:
"INSIST((valoptions & 0x0002U) != 0) failed") or db.c (error
message: "REQUIRE(targetp != ((void *)0) && *targetp == ((void
*)0)) failed").
A server encountering either of these error conditions will stop,
resulting in denial of service to clients. The risk to authoritative
servers is minimal; recursive servers are chiefly at risk.
Discussion:
Acknowledgments:
Bugzilla
CVE-2015-2181 CVE-2015-8864 CVE-2016-4068 CVE-2016-4069 roundcubemail: security issues fixed in version 1.0.9
bugzilla·2016-04-25·CVSS 8.8
CVE-2015-2181 [HIGH] CVE-2015-2181 CVE-2015-8864 CVE-2016-4068 CVE-2016-4069 roundcubemail: security issues fixed in version 1.0.9
CVE-2015-2181 CVE-2015-8864 CVE-2016-4068 CVE-2016-4069 roundcubemail: security issues fixed in version 1.0.9
Three issues were fixed in roundcubemail 1.0.9:
https://github.com/roundcube/roundcubemail/releases/tag/1.0.9
(CVE-2015-8864,CVE-2016-4068) Fix XSS issue in SVG images handling (#4949):
https://github.com/roundcube/roundcubemail/issues/4949
(CVE-2016-4069) Protect download urls against CSRF using unique request tokens (#4957):
https://github.com/roundcube/roundcubemail/issues/4957
(CVE-2015-2181) Fix (again) security issue in DBMail driver of password plugin (#4958):
https://github.com/roundcube/roundcubemail/issues/4958
Discussion:
Created roundcubemail tracking bugs for this issue:
Affects: fedora-all [bug 1330085]
Affects: epel-all [bug 1330086]
---
roundcubemail-1.
http://rhn.redhat.com/errata/RHSA-2016-2141.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2142.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2615.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2871.htmlhttp://www.debian.org/security/2016/dsa-3703http://www.securityfocus.com/bid/94067http://www.securitytracker.com/id/1037156https://access.redhat.com/errata/RHSA-2017:1583https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05381687https://kb.isc.org/article/AA-01434https://kb.isc.org/article/AA-01435https://kb.isc.org/article/AA-01436https://kb.isc.org/article/AA-01437https://kb.isc.org/article/AA-01438https://security.FreeBSD.org/advisories/FreeBSD-SA-16:34.bind.aschttps://security.gentoo.org/glsa/201701-26https://security.netapp.com/advisory/ntap-20180926-0005/http://rhn.redhat.com/errata/RHSA-2016-2141.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2142.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2615.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2871.htmlhttp://www.debian.org/security/2016/dsa-3703http://www.securityfocus.com/bid/94067http://www.securitytracker.com/id/1037156https://access.redhat.com/errata/RHSA-2017:1583https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05381687https://kb.isc.org/article/AA-01434https://kb.isc.org/article/AA-01435https://kb.isc.org/article/AA-01436https://kb.isc.org/article/AA-01437https://kb.isc.org/article/AA-01438https://security.FreeBSD.org/advisories/FreeBSD-SA-16:34.bind.aschttps://security.gentoo.org/glsa/201701-26https://security.netapp.com/advisory/ntap-20180926-0005/
2016-11-02
Published