Debian DLA-957-1 : bind9 security update
Medium Nessus Plugin ID 100477
SynopsisThe remote Debian host is missing a security update.
Oleg Gorokhov of Yandex discovered that BIND does not properly handle certain queries when using DNS64 with the 'break-dnssec yes;' option, allowing a remote attacker to cause a denial of service.
It was discovered that BIND makes incorrect assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records, leading to situations where BIND exits with an assertion failure. An attacker can take advantage of this condition to cause a denial of service.
Mike Lalumiere of Dyn, Inc. discovered that BIND can exit with a REQUIRE assertion failure if it receives a null command string on its control channel. Note that the fix applied in Debian is only applied as a hardening measure. Details about the issue can be found at https://kb.isc.org/article/AA-01471 .
For Debian 7 'Wheezy', these problems have been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u16.
We recommend that you upgrade your bind9 packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpgrade the affected packages.