6.5
CVSSv3

CVE-2015-8704

Published: 20/01/2016 Updated: 30/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.9 | Exploitability Score: 8
CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8
VMScore: 607
Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C

Vulnerability Summary

apl_42.c in ISC BIND 9.x prior to 9.9.8-P3, 9.9.x, and 9.10.x prior to 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.10.3

isc bind 9.10.2

isc bind 9.10.1

isc bind 9.6

isc bind 9.5.1

isc bind 9.5.0

isc bind 9.4.2

isc bind 9.3.2

isc bind 9.3.1

isc bind 9.2.3

isc bind 9.2.2

isc bind 9.1

isc bind 9.0.1

isc bind 9.9.8

isc bind 9.5.3

isc bind 9.5.2

isc bind 9.4.3

isc bind 9.4.0

isc bind 9.2.7

isc bind 9.2.6

isc bind 9.2

isc bind 9.1.3

isc bind 9.4

isc bind 9.3.3

isc bind 9.2.5

isc bind 9.2.4

isc bind 9.1.2

isc bind 9.1.1

isc bind 9.5

isc bind 9.4.1

isc bind 9.3.0

isc bind 9.3

isc bind 9.2.1

isc bind 9.2.0

isc bind 9.0

Vendor Advisories

Debian Bug report logs - #812077 bind9: CVE-2015-8704: Specific APL data could trigger an INSIST in apl_42c Package: src:bind9; Maintainer for src:bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 20 Jan 2016 09:36:02 UTC Severity: serious Tags: ...
Bind could be made to crash if it received specially crafted network traffic ...
It was discovered that specific APL RR data could trigger an INSIST failure in apl_42c and cause the BIND DNS server to exit, leading to a denial-of-service For the oldstable distribution (wheezy), this problem has been fixed in version 1:984dfsgP1-6+nmu2+deb7u9 For the stable distribution (jessie), this problem has been fixed in version 1:9 ...
Specific APL RR data could cause a server to exit due to an INSIST failure in apl_42c when performing certain string formatting operations (CVE-2015-8704) CVE-2015-8705 was also issued today for bind, but the Amazon Linux AMI's version of bind is not impacted by that CVE ...
A denial of service flaw was found in the way BIND processed certain malformed Address Prefix List (APL) records A remote, authenticated attacker could use this flaw to cause named to crash ...

References

CWE-20https://kb.isc.org/article/AA-01335https://kb.isc.org/article/AA-01380http://marc.info/?l=bugtraq&m=145680832702035&w=2http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.htmlhttp://www.securityfocus.com/bid/81329http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178045.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0073.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0074.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00020.htmlhttp://www.securitytracker.com/id/1034739http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175973.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00025.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00023.htmlhttp://www.debian.org/security/2016/dsa-3449http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00024.htmlhttps://www.freebsd.org/security/advisories/FreeBSD-SA-16:08.bind.aschttp://www.ubuntu.com/usn/USN-2874-1https://kb.isc.org/article/AA-01438https://security.gentoo.org/glsa/201610-07https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812077https://usn.ubuntu.com/2874-1/https://nvd.nist.gov