Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-6170

ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.

Published

2016-07-06T14:59:05.597

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-20

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	isc	bind	≤ 9.9.8	Yes
Application	isc	bind	≤ 9.10.3	Yes
Application	isc	bind	9.9.9	Yes
Application	isc	bind	9.9.9	Yes
Application	isc	bind	9.9.9	Yes
Application	isc	bind	9.9.9	Yes
Application	isc	bind	9.10.4	Yes
Application	isc	bind	9.10.4	Yes
Application	isc	bind	9.11.0	Yes
Application	isc	bind	9.11.0	Yes
Application	isc	bind	9.11.0	Yes
Application	isc	bind	9.11.0	Yes
Operating System	redhat	enterprise_linux	5.0	Yes
Operating System	redhat	enterprise_linux	6.0	Yes
Operating System	redhat	enterprise_linux	7.0	Yes

References

http://www.openwall.com/lists/oss-security/2016/07/06/3 Mailing List, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/91611 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1036241 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=1353563 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/sischkg/xfer-limit/blob/master/README.md Exploit, Patch, Third Party Advisory ([email protected])
https://kb.isc.org/article/AA-01390 Vendor Advisory ([email protected])
https://kb.isc.org/article/AA-01390/169/CVE-2016-6170 Vendor Advisory ([email protected])
https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015058.html Mailing List, Third Party Advisory ([email protected])
https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015073.html Mailing List, Third Party Advisory ([email protected])
https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015075.html Mailing List, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/201610-07 Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2016/07/06/3 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/91611 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1036241 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=1353563 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sischkg/xfer-limit/blob/master/README.md Exploit, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.isc.org/article/AA-01390 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.isc.org/article/AA-01390/169/CVE-2016-6170 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015058.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015073.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015075.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201610-07 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)