ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

The version of bind installed on the remote AIX host is affected by the following vulnerabilities :

  - A denial of service vulnerability exists when handling     malformed options sections. An unauthenticated, remote     attacker can exploit this, via a specially crafted OPT     resource record, to cause an assertion failure,     resulting in a daemon exit. (CVE-2016-2848)

  - A denial of service vulnerability exists due to improper     handling of a recursive response containing a DNAME     record in the answer section. An unauthenticated, remote     attacker can exploit this to cause an assertion failure     and daemon exit. (CVE-2016-8864)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

  - Fix (CVE-2016-2848)

  - Fix infinite loop in start_lookup (#1306504)

  - Fix (CVE-2016-2776)

Versions of ISC BIND 9.x prior to 9.8.5, and 9.9.x prior to 9.9.3 are unpatched for a flaw that is triggered when handling a packet with a malformed options section.  This may allow a remote attacker to trigger an assertion failure and cause a server to exit.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is 9.x prior to 9.9.9-P3. It is, therefore, affected by a denial of service vulnerability when handling malformed options sections. An unauthenticated, remote attacker can exploit this, via a specially crafted OPT resource record, to cause an assertion failure, resulting in a daemon exit.

An update for bind is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support, Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.5 Telco Extended Update Support, Red Hat Enterprise Linux 6.6 Extended Update Support, and Red Hat Enterprise Linux 6.7 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND constructed a response to a query that met certain criteria. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS request packet. (CVE-2016-2776)

* A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet. (CVE-2016-2848)

Red Hat would like to thank ISC for reporting CVE-2016-2776.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2016-2848)

From Red Hat Security Advisory 2016:2094 :

An update for bind97 is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet. (CVE-2016-2848)

From Red Hat Security Advisory 2016:2093 :

An update for bind is now available for Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet. (CVE-2016-2848)

An update for bind97 is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet. (CVE-2016-2848)

An update for bind is now available for Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet. (CVE-2016-2848)

Toshifumi Sakaguchi discovered that Bind incorrectly handled certain packets with malformed options. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A denial of service flaw was found in the way BIND     handled packets with malformed options. A remote     attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS packet. (CVE-2016-2848)

CVE-2016-2848 A server vulnerable to this defect can be forced to exit with an assertion failure if it receives a malformed packet.
Authoritative and recursive servers are both vulnerable.

For Debian 7 'Wheezy', these problems have been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u12.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2016-2848 bind: assertion failure triggered by a packet with malformed options

A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet.

ID	Name	Product	Family	Severity
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	medium
102126	AIX bind Advisory : bind_advisory14.asc (IV91214) (IV91253) (IV91254) (IV91255) (IV91256) (IV91257)	Nessus	AIX Local Security Checks	high
99569	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	high
9876	ISC BIND 9.x < 9.8.5 / 9.9.x < 9.9.3 Multiple Vulnerabilities	Nessus Network Monitor	DNS Servers	high
94611	ISC BIND 9.x < 9.9.9-P3 Options Sections DoS	Nessus	DNS	high
94344	F5 Networks BIG-IP : BIND vulnerability (SOL01471335)	Nessus	F5 Networks Local Security Checks	high
94265	RHEL 6 : bind (RHSA-2016:2099)	Nessus	Red Hat Local Security Checks	high
94227	OracleVM 3.2 : bind (OVMSA-2016-0146)	Nessus	OracleVM Local Security Checks	high
94226	OracleVM 3.3 / 3.4 : bind (OVMSA-2016-0145)	Nessus	OracleVM Local Security Checks	high
94222	Oracle Linux 5 : bind97 (ELSA-2016-2094)	Nessus	Oracle Linux Local Security Checks	high
94221	Oracle Linux 5 / 6 : bind (ELSA-2016-2093)	Nessus	Oracle Linux Local Security Checks	high
94203	CentOS 5 : bind97 (CESA-2016:2094)	Nessus	CentOS Local Security Checks	high
94202	CentOS 5 / 6 : bind (CESA-2016:2093)	Nessus	CentOS Local Security Checks	high
94195	Ubuntu 12.04 LTS : bind9 vulnerability (USN-3108-1)	Nessus	Ubuntu Local Security Checks	high
94194	Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64 (20161020)	Nessus	Scientific Linux Local Security Checks	high
94193	Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20161020)	Nessus	Scientific Linux Local Security Checks	high
94192	RHEL 5 : bind97 (RHSA-2016:2094)	Nessus	Red Hat Local Security Checks	high
94191	RHEL 5 / 6 : bind (RHSA-2016:2093)	Nessus	Red Hat Local Security Checks	high
94184	Debian DLA-672-1 : bind9 security update	Nessus	Debian Local Security Checks	high
94183	Amazon Linux AMI : bind (ALAS-2016-758)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2016-2848

high

Tenable Plugins

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high