DSA-2547-1 bind9 -- improper assert

Debian Security Advisory

DSA-2547-1 bind9 -- improper assert

Date Reported:

12 Sep 2012

Affected Packages:

bind9

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2012-4244.

More information:

It was discovered that BIND, a DNS server, does not handle DNS records properly which approach size limits inherent to the DNS protocol. An attacker could use crafted DNS records to crash the BIND server process, leading to a denial of service.

For the stable distribution (squeeze), this problem has been fixed in version 1:9.7.3.dfsg-1~squeeze7.

We recommend that you upgrade your bind9 packages.