Bug 1378380 (CVE-2016-2776) - CVE-2016-2776 bind: assertion failure in buffer.c while building responses to a specifically constructed request
Summary: CVE-2016-2776 bind: assertion failure in buffer.c while building responses to...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-2776
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1379214 1379215 1379219 1379220 1379247 1379249 1379818 1379819 1384591 1384592 1384593 1384594 1384808 1429957
Blocks: 1378299
TreeView+ depends on / blocked
 
Reported: 2016-09-22 10:11 UTC by Dhiru Kholia
Modified: 2021-02-17 03:17 UTC (History)
9 users (show)

Fixed In Version: bind 9.9.9-P3, bind 9.10.4-P3
Doc Type: If docs needed, set a value
Doc Text:
A denial of service flaw was found in the way BIND constructed a response to a query that met certain criteria. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS request packet.
Clone Of:
Environment:
Last Closed: 2016-09-28 20:03:24 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1944 0 normal SHIPPED_LIVE Important: bind security update 2016-09-28 17:33:23 UTC
Red Hat Product Errata RHSA-2016:1945 0 normal SHIPPED_LIVE Important: bind97 security update 2016-09-28 15:20:15 UTC
Red Hat Product Errata RHSA-2016:2099 0 normal SHIPPED_LIVE Important: bind security update 2016-10-25 12:47:07 UTC

Description Dhiru Kholia 2016-09-22 10:11:33 UTC 
The following flaw, reported by ISC, was found in all versions of BIND 9 (9.0.x -> 9.8.x, 9.9.0->9.9.9-P2, 9.9.3-S1->9.9.9-S3,9.10.0->9.10.4-P2):

A defect in the rendering of messages into packets can cause named to exit with an assertion failure in buffer.c while constructing a response to a query that meets certain criteria.

This assertion can be triggered even if the apparent source address isn't allowed to make queries (i.e. doesn't match 'allow-query').

This flaw is fixed in upstream versions 9.9.9-P3 and 9.10.4-P3.
Comment 1 Dhiru Kholia 2016-09-22 10:11:41 UTC 
Acknowledgments:

Name: ISC
Comment 8 Martin Prpič 2016-09-27 18:08:24 UTC 
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1379818]
Comment 9 Martin Prpič 2016-09-27 18:08:31 UTC 
Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1379819]
Comment 10 Martin Prpič 2016-09-27 18:08:56 UTC 
External References:

https://kb.isc.org/article/AA-01419/0
Comment 11 errata-xmlrpc 2016-09-28 11:23:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2016:1945 https://rhn.redhat.com/errata/RHSA-2016-1945.html
Comment 12 errata-xmlrpc 2016-09-28 13:37:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2016:1944 https://rhn.redhat.com/errata/RHSA-2016-1944.html
Comment 13 Dhiru Kholia 2016-10-04 06:36:11 UTC 
An exploit for this flaw is now public. For details see the following links,

https://github.com/infobyte/CVE-2016-2776/blob/master/namedown.py
https://github.com/rapid7/metasploit-framework/pull/7382
http://blog.infobytesec.com/2016/10/a-tale-of-dns-packet-cve-2016-2776.html
Comment 14 Tomas Hoger 2016-10-04 07:25:44 UTC 
Upstream commit:

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=2bd0922cf995b9ac205fc83baf7e220b95c6bf12
Comment 17 errata-xmlrpc 2016-10-25 08:47:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support
  Red Hat Enterprise Linux 6.6 Extended Update Support
  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.4 Advanced Update Support
  Red Hat Enterprise Linux 6.2 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support

Via RHSA-2016:2099 https://rhn.redhat.com/errata/RHSA-2016-2099.html
Note You need to log in before you can comment on or make changes to this bug.