CVE-2016-2775: Input Validation
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
Other sources
It was found that if the lightweight resolver is asked to resolve a query name which, when combined with a search list entry, exceeds the maximum allowable length, the server can terminate due to an error. If configured to use lwres lightweight resolver protocol accepting remote client connections, remote attacker can cause DoS by submitting large query.
External Reference:
https://kb.isc.org/article/AA-01393/
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2775?
CVE-2016-2775 has a severity level classified as High due to its potential to allow remote denial of service.
How do I fix CVE-2016-2775?
To fix CVE-2016-2775, update ISC BIND to version 9.9.9-P2, 9.10.4-P2, or 9.11.0b2 or later.
What systems are affected by CVE-2016-2775?
CVE-2016-2775 affects ISC BIND versions prior to 9.9.9-P2, 9.10.4-P2, and 9.11.0b2.
What kind of attack can exploit CVE-2016-2775?
An attacker can exploit CVE-2016-2775 by sending a long request using the lightweight resolver protocol to cause a daemon crash.
Is there a workaround for CVE-2016-2775?
A potential workaround for CVE-2016-2775 is to disable the lwresd or the named lwres option if not needed.