CVE-2016-6170 Denial of service in n/a
Remote attackers can crash DNS servers by sending large AXFR, IXFR, or UPDATE messages, causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6170?
CVE-2016-6170 is a medium-severity denial of service vulnerability in Isc Bind, published on 6 Jul 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.
Weakness: CWE-20
Which versions are affected by CVE-2016-6170?
It affects 2 products.
Products include Isc Bind, Redhat Enterprise Linux.
How do I fix CVE-2016-6170?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-6170 being exploited?
There is no known exploitation of CVE-2016-6170 in the wild and no public exploit code.
Other vulnerabilities in Isc Bind
Sources
Also known as DEBIAN-CVE-2016-6170, GHSA-r98f-r8h7-rj5p, UBUNTU-CVE-2016-6170.