CVE-2014-8680: Input Validation

Published Dec 11, 2014

Updated

The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options.

Affected Software

2 affected components

ISC BIND=9.10.0

ISC BIND=9.10.1

Event History

Dec 11, 2014

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8680?

CVE-2014-8680 has a critical severity level as it allows remote attackers to cause denial of service.

How do I fix CVE-2014-8680?

To fix CVE-2014-8680, upgrade ISC BIND to version 9.10.2 or later where the GeoIP functionality has been patched.

What versions of ISC BIND are affected by CVE-2014-8680?

CVE-2014-8680 affects ISC BIND versions 9.10.0 and 9.10.1.

What types of attacks does CVE-2014-8680 enable?

CVE-2014-8680 enables remote denial of service attacks through assertion failures in the GeoIP functionality.

Is CVE-2014-8680 related to IPv4 or IPv6?

CVE-2014-8680 is related to both IPv4 and IPv6, specifically the lack of GeoIP databases and certain IPv6 options.