Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2016-1285

Published: 09/03/2016 Updated: 30/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.8 | Impact Score: 4 | Exploitability Score: 2.2
VMScore: 385
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Isc

Vulnerability Summary

named in ISC BIND 9.x prior to 9.9.8-P4 and 9.10.x prior to 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote malicious users to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.10.3

isc bind 9.9.8

isc bind

suse linux enterprise server 11

suse linux enterprise debuginfo 11

suse openstack cloud 5

suse manager proxy 2.1

suse linux enterprise desktop 11

suse linux enterprise software development kit 12

suse manager 2.1

suse linux enterprise server 12

opensuse opensuse 11.4

suse linux enterprise software development kit 11

suse linux enterprise desktop 12

opensuse leap 42.1

opensuse opensuse 13.1

opensuse opensuse 13.2

fedoraproject fedora 22

fedoraproject fedora 24

fedoraproject fedora 23

canonical ubuntu linux 15.10

canonical ubuntu linux 14.04

canonical ubuntu linux 12.04

debian debian linux 8.0

debian debian linux 7.0

debian debian linux 9.0

juniper junos 12.1x46

juniper junos 12.1x46-d10

juniper junos 12.1x46-d76

juniper junos 12.3x48

juniper junos 15.1x49

juniper junos 17.3

juniper junos 17.4

juniper junos 18.1

juniper junos 18.2

juniper junos 18.3

juniper junos 18.4

Vendor Advisories

Ubuntu Security Notice: bind9 vulnerabilities
Bind could be made to crash if it received specially crafted network traffic ...
Amazon Linux AMI: ALAS-2016-665
A defect in control channel input handling was discovered which can cause named to exit due to an assertion failure in sexprc or alistc when a malformed packet is sent to named's control channel If control channel input is accepted from the network (limited to localhost by default), an unauthenticated attacker could cause named to crash (CVE-20 ...
Red Hat: CVE-2016-1285
A denial of service flaw was found in the way BIND processed certain control channel input A remote attacker able to send a malformed packet to the control channel could use this flaw to cause named to crash ...

References

NVD-CWE-noinfohttps://kb.isc.org/article/AA-01352https://kb.isc.org/article/AA-01380http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00013.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05087821http://marc.info/?l=bugtraq&m=146191105921542&w=2http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0601.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/181036.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0562.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179911.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/181037.htmlhttp://www.securitytracker.com/id/1035236http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00053.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00072.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/178880.htmlhttp://www.ubuntu.com/usn/USN-2925-1http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00070.htmlhttp://www.debian.org/security/2016/dsa-3511http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00046.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/178831.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00084.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179904.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00079.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00075.htmlhttps://kb.isc.org/article/AA-01438https://security.gentoo.org/glsa/201610-07https://security.FreeBSD.org/advisories/FreeBSD-SA-16:13.bind.aschttps://usn.ubuntu.com/2925-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
deserializationCVE-2024-4040cross-site scriptingCVE-2023-25790CVE-2024-2961XML external entityCVE-2024-26926CVE-2024-32806CVE-2024-32711
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook