Synopsis
The remote AIX host has a version of bind installed that is affected by multiple denial of service vulnerabilities.
Description
The version of bind installed on the remote AIX host is affected by the following vulnerabilities :
- A denial of service vulnerability exists due to an error in the lightweight resolver (lwres) protocol implementation when resolving a query name that, when combined with a search list entry, exceeds the maximum allowable length. An unauthenticated, remote attacker can exploit this to cause a segmentation fault, resulting in a denial of service condition. This issue occurs when lwresd or the the named 'lwres' option is enabled. (CVE-2016-2775)
- A denial of service vulnerability exists within file buffer.c due to improper construction of responses to crafted requests. An unauthenticated, remote attacker can exploit this, via a specially crafted query, to cause an assertion failure, resulting in a daemon exit.
(CVE-2016-2776)
Solution
A fix is available and can be downloaded from the IBM AIX website.