Bug 1171919 – CVE-2014-8680 bind: flaws in GeoIP leading to a denial of service

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1171919 - (CVE-2014-8680) CVE-2014-8680 bind: flaws in GeoIP leading to a denial of service

Summary:	CVE-2014-8680 bind: flaws in GeoIP leading to a denial of service

Status:	CLOSED NOTABUG

Aliases:	CVE-2014-8680

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20141208,repor...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2014-12-08 19:04 EST by Murray McAllister
Modified:	2018-09-03 20:06 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	bind 9.10.1-P1
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-12-08 19:05:58 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Murray McAllister 2014-12-08 19:04:46 EST

BIND 9.10.1-P1 fixes the following flaws:

""
Multiple errors have been identified in the GeoIP features added in BIND 9.10.  Two are capable of crashing BIND -- triggering either can cause named to exit with an assertion failure, resulting in a denial of service condition.  A third defect is also corrected, which could have caused GeoIP databases to not be loaded properly if their location was changed while BIND was running.

Only servers built to include GeoIP functionality are affected.
""

The affected versions (9.10.0 to 9.10.1) are not shipped in Red Hat Enterprise Linux or Fedora.

External References:

https://kb.isc.org/article/AA-01217/74/CVE-2014-8680%3A-Defects-in-GeoIP-features-can-cause-BIND-to-crash.html

Comment 1 Murray McAllister 2014-12-08 19:05:14 EST

Statement:

Not vulnerable. This issue did not affect the versions of bind or bind97 as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Note You need to log in before you can comment on or make changes to this bug.