libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bind | Aug 30, 2017 | Jun 13, 2014 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Jun 12, 2014 | Jun 11, 2014 |
| Suse | — | Upgrade libisc1606Upgrade libisccc1600Upgrade libbind9-160Upgrade libbind9-1600Upgrade libirs160Upgrade libirs-develUpgrade libirs1601Upgrade libisccfg1600Upgrade libdns169Upgrade libdns1605Upgrade bind-utilsUpgrade libisc166Upgrade libisccfg160Upgrade bind-docUpgrade libns1604Upgrade libisccc160Upgrade bindUpgrade bind-chrootenvUpgrade bind-develUpgrade python3-bindUpgrade liblwres160 | May 20, 2018 | Jun 13, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub