CVEvulnerability

CVE-2016-1285

6.8 MEDIUM Published 2016-03-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-03-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P

Description

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

Affected configurations

• isc bind (>= 9.0.0 < 9.9.8) • isc bind (>= 9.10.0 < 9.10.3) • isc bind 9.9.8 • isc bind 9.10.3 • suse linux enterprise debuginfo 11 • suse manager 2.1 • suse manager proxy 2.1 • suse openstack cloud 5 • opensuse leap 42.1 • opensuse opensuse 11.4 • opensuse opensuse 13.1 • opensuse opensuse 13.2 • suse linux enterprise desktop 11 • suse linux enterprise desktop 12 • suse linux enterprise server 11 • suse linux enterprise server 12 • suse linux enterprise software development kit 11 • suse linux enterprise software development kit 12 • fedoraproject fedora 22 • fedoraproject fedora 23 • fedoraproject fedora 24 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.10 • debian debian linux 7.0 • debian debian linux 8.0 • debian debian linux 9.0 • juniper junos 12.1x46 • juniper junos 12.1x46-d10 • juniper junos 12.1x46-d76 • juniper junos 12.3x48 • juniper junos 15.1x49 • juniper junos 17.3 • juniper junos 17.4 • juniper junos 18.1 • juniper junos 18.2 • juniper junos 18.3 • juniper junos 18.4

References