CVE-2015-8705: Input Validation

Published Jan 20, 2016

Updated

buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.

Affected Software

59 affected components

ISC BIND=9.0

ISC BIND=9.0.1

ISC BIND=9.1

ISC BIND=9.1.1

ISC BIND=9.1.2

ISC BIND=9.1.3

ISC BIND=9.2

ISC BIND=9.2.0

ISC BIND=9.2.1

ISC BIND=9.2.2

ISC BIND=9.2.2-p3

ISC BIND=9.2.3

ISC BIND=9.2.4

ISC BIND=9.2.5

ISC BIND=9.2.6

ISC BIND=9.2.7

ISC BIND=9.3

ISC BIND=9.3.0

ISC BIND=9.3.1

ISC BIND=9.3.2

ISC BIND=9.3.3

ISC BIND=9.4

ISC BIND=9.4.0

ISC BIND=9.4.0-rc1

ISC BIND=9.4.1

ISC BIND=9.4.2

ISC BIND=9.4.3

ISC BIND=9.4.3-rc1

ISC BIND=9.5

ISC BIND=9.5.0

ISC BIND=9.5.0-rc1

ISC BIND=9.5.1

ISC BIND=9.5.1-rc1

ISC BIND=9.5.1-rc2

ISC BIND=9.5.2

ISC BIND=9.5.2-rc1

ISC BIND=9.5.3

ISC BIND=9.5.3-rc1

ISC BIND=9.6

ISC BIND=9.6-r5_p1

ISC BIND=9.6-r6_b1

ISC BIND=9.6-r6_rc1

ISC BIND=9.6-r6_rc2

ISC BIND=9.6-r7_p1

ISC BIND=9.6-r7_p2

ISC BIND=9.9.8-p2

ISC BIND=9.10.1

ISC BIND=9.10.1-p1

ISC BIND=9.10.2

ISC BIND=9.10.2-b1

ISC BIND=9.10.2-p1

ISC BIND=9.10.2-p2

ISC BIND=9.10.2-p3

ISC BIND=9.10.2-p4

ISC BIND=9.10.2-rc1

ISC BIND=9.10.3

ISC BIND=9.10.3-p1

ISC BIND=9.10.3-p2

ISC BIND=9.10.3-rc1

Event History

Jan 20, 2016

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-8705?

CVE-2015-8705 has a severity rating that indicates it can lead to denial of service due to assertion failure or daemon crash when debug logging is enabled.

How do I fix CVE-2015-8705?

To fix CVE-2015-8705, upgrade ISC BIND to version 9.10.3-P3 or later where the vulnerability is resolved.

What can be exploited in CVE-2015-8705?

CVE-2015-8705 can be exploited through crafted OPT data or ECS options which may trigger assertion failures.

Who is impacted by CVE-2015-8705?

Organizations using ISC BIND versions 9.10.x before 9.10.3-P3 with debug logging enabled are impacted by CVE-2015-8705.

What type of vulnerability is CVE-2015-8705?

CVE-2015-8705 is classified as a denial of service vulnerability due to its potential to crash the BIND daemon.