CVE-2016-8864: High severity isc bind 9 vulnerability
A defect in BIND's handling of responses containing a DNAME answer can cause a resolver to exit after encountering an assertion failure in db.c or resolver.c
During processing of a recursive response that contains a DNAME record in the answer section, BIND can stop execution after encountering an assertion error in resolver.c (error message: "INSIST((valoptions & 0x0002U) != 0) failed") or db.c (error message: "REQUIRE(targetp != ((void )0) && targetp == ((void )0)) failed").
A server encountering either of these error conditions will stop, resulting in denial of service to clients. The risk to authoritative servers is minimal; recursive servers are chiefly at risk.
Other sources
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8864?
The severity of CVE-2016-8864 is considered high due to the potential for a resolver to terminate unexpectedly.
How do I fix CVE-2016-8864?
To fix CVE-2016-8864, upgrade to the latest version of BIND as specified in the vulnerability report.
Which versions of BIND are affected by CVE-2016-8864?
CVE-2016-8864 affects various versions of BIND, specifically versions earlier than 9.11.0.
What impact does CVE-2016-8864 have on BIND users?
CVE-2016-8864 can cause BIND resolvers to crash, potentially leading to denial of service.
Is there a workaround for CVE-2016-8864 if I cannot update BIND?
Currently, the only recommended solution for CVE-2016-8864 is to apply the provided patches or update to a fixed version of BIND.