Security Alert (A15-07-11): Vulnerability in ISC BIND

Description:

A vulnerability is found in the Internet Systems Consortium (ISC) BIND software. A remote attacker could send a specially crafted packets to exploit an error in the handling of TKEY queries and trigger a REQUIRE assertion failure, causing BIND to exit. Access control lists or configuration options limiting or denying service cannot prevent the problem.

Both authoritative and recursive name servers are vulnerable to this problem.

Affected Systems:

• BIND 9.1.0 to 9.8.x
• BIND 9.9.0 to 9.9.7-P1
• BIND 9.10.0 to 9.10.2-P2

Impact:

Successful exploitation could lead to denial of service (DoS) condition on an affected system.

Recommendation:

ISC has released the following patches to solve the problem:

• BIND 9.9.7-P2 and 9.10.2-P3
  http://www.isc.org/downloads/
  
  

Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

More Information:

https://kb.isc.org/article/AA-01272
https://www.us-cert.gov/ncas/current-activity/2015/07/28/Internet-Systems-Consortium-ISC-Releases-Security-Updates-BIND
https://exchange.xforce.ibmcloud.com/vulnerabilities/105120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5477