Severity
Medium
Vendor
Ubuntu, Bind9
Versions Affected
- Ubuntu 14.04 LTS
Description
Bind could be made to crash if it received specially crafted network traffic.
It was discovered that Bind incorrectly handled input received by the rndc control channel. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1285)
It was discovered that Bind incorrectly parsed resource record signatures for DNAME resource records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1286)
Affected Products and Versions
Severity is medium unless otherwise noted.
- All versions of Cloud Foundry rootfs prior to 1.43.0 AND stemcell 3146.x versions prior to 3146.10 AND all other stemcell versions prior to 3215
Mitigation
Users of affected versions should apply the following mitigation:
- The Cloud Foundry project recommends that Cloud Foundry deployments upgrade rootfs to version 1.43.0 or later
- The Cloud Foundry project recommends that Cloud Foundry deployments upgrade stemcell versions 3146.x to 3146.10 or later OR all other stemcell versions to 3215 or later
Credit
None
