Bug 1315680 (CVE-2016-1286)

The following flaw, reported by ISC, was found in BIND:

An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c.

An attacker able to cause a server to make a query deliberately chosen to generate a response containing a signature record which would exercise this vulnerability can cause named to stop execution with an assertion failure, resulting in denial of service to clients. Recursive resolvers are at the highest risk of vulnerability to this attack but authoritative-only servers may be also be vulnerable if the attacker can control the answers for records requested when the authoritative server is performing service on zones (e.g. a slave server doing SOA queries.) Servers may be affected even if they are not performing validation or have DNSSEC disabled entirely as long as they receive a response containing offending signature records. Disabling DNSSEC does not provide protection against this vulnerability.

External References:

https://kb.isc.org/article/AA-01353