CVE-2016-1285

Priority
Medium
Description
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not
properly handle DNAME records when parsing fetch reply messages, which
allows remote attackers to cause a denial of service (assertion failure and
daemon exit) via a malformed packet to the rndc (aka control channel)
interface, related to alist.c and sexpr.c.
References
Assigned-to
mdeslaur
Package
Source: bind9 (LP Ubuntu Debian)
Upstream:released (9.9.8-P4, 9.10.3-P4)
Ubuntu 17.10 (Artful Aardvark):not-affected (1:9.10.3.dfsg.P4-1)
Ubuntu 12.04 ESM (Precise Pangolin):released (1:9.8.1.dfsg.P1-4ubuntu0.16)
Ubuntu 14.04 LTS (Trusty Tahr):released (1:9.9.5.dfsg-3ubuntu0.8)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (1:9.10.3.dfsg.P4-1)
Ubuntu 17.04 (Zesty Zapus):not-affected (1:9.10.3.dfsg.P4-1)
More Information

Updated: 2017-10-17 19:14:16 UTC (commit 13537)