bind9 vulnerabilities

Related Vulnerabilities: CVE-2017-3135  

Bind could be made to crash if it received specially crafted network traffic.

It was discovered that Bind incorrectly handled rewriting certain query responses when using both DNS64 and RPZ. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

16 February 2017

bind9 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Bind could be made to crash if it received specially crafted network traffic.

Software Description

  • bind9 - Internet Domain Name Server

Details

It was discovered that Bind incorrectly handled rewriting certain query responses when using both DNS64 and RPZ. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.10
bind9 - 1:9.10.3.dfsg.P4-10.1ubuntu1.3
Ubuntu 16.04 LTS
bind9 - 1:9.10.3.dfsg.P4-8ubuntu1.5
Ubuntu 14.04 LTS
bind9 - 1:9.9.5.dfsg-3ubuntu0.13
Ubuntu 12.04 LTS
bind9 - 1:9.8.1.dfsg.P1-4ubuntu0.21

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References