CVE-2016-9778 An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c
Attackers can cause a denial of service in BIND servers using the nxdomain-redirect feature by triggering an assertion failure with specific queries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9778?
CVE-2016-9778 is a high-severity denial of service vulnerability in Isc Bind, published on 16 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the "nxdomain-redirect" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type "redirect" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.
Weakness: CWE-388
Which versions are affected by CVE-2016-9778?
It affects 3 products.
Products include Isc Bind, Netapp Data Ontap Edge, Netapp Solidfire Element Os Management Node.
How do I fix CVE-2016-9778?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-9778 being exploited?
There is no known exploitation of CVE-2016-9778 in the wild and no public exploit code.
Other vulnerabilities in Isc Bind
Sources
Also known as GHSA-xf9m-fv8p-cjv5.