USN-2925-1 Bind9 vulnerabilities

Medium

Vendor

Ubuntu, Bind9

Versions Affected

• Ubuntu 14.04 LTS

Description

Bind could be made to crash if it received specially crafted network traffic.

It was discovered that Bind incorrectly handled input received by the rndc control channel. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1285)

It was discovered that Bind incorrectly parsed resource record signatures for DNAME resource records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1286)

Affected Products and Versions

_Severity is medium unless otherwise noted.
_

• All versions of Cloud Foundry rootfs prior to 1.43.0 AND stemcell 3146.x versions prior to 3146.10 AND all other stemcell versions prior to 3215

Mitigation

Users of affected versions should apply the following mitigation:

• The Cloud Foundry project recommends that Cloud Foundry deployments upgrade rootfs to version 1.43.0 or later
• The Cloud Foundry project recommends that Cloud Foundry deployments upgrade stemcell versions 3146.x to 3146.10 or later OR all other stemcell versions to 3215 or later

Credit

None

References

• <http://www.ubuntu.com/usn/usn-2925-1/&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1285.html&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1286.html&gt;