CVE-2016-9131: Input Validation
A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties, after having engineered a scenario whereby an ANY query is sent to the recursive server for the target QNAME. A recursive server will itself only send a query of type ANY if it receives a client query of type ANY for a QNAME for which it has no RRsets at all in cache, otherwise it will respond to the client with the the RRsets that it has available.
This vulnerability occurs during the processing of an answer packet received in response to a query. As a result, recursive servers are at the greatest risk; authoritative servers are at risk only to the extent that they perform a limited set of queries.
This description is borrowed from the upstream advisory.
Other sources
named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9131?
CVE-2016-9131 has a severity rating of critical due to its potential for remote denial of service attacks.
How do I fix CVE-2016-9131?
To fix CVE-2016-9131, upgrade your ISC BIND to the latest version that is not affected, such as versions 9.9.9-P5, 9.10.4-P5, or 9.11.0-P2 and above.
What versions of ISC BIND are affected by CVE-2016-9131?
CVE-2016-9131 affects ISC BIND versions prior to 9.9.9-P5, 9.10.4-P5, and 9.11.0-P2.
Can CVE-2016-9131 be exploited remotely?
Yes, CVE-2016-9131 can be exploited remotely by attackers sending malformed responses to RTYPE ANY queries.
What impact does CVE-2016-9131 have on affected systems?
CVE-2016-9131 can cause an assertion failure resulting in the BIND daemon crashing, leading to a denial of service.