Vulnerability Intelligence Report
CVE-2016-1285
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
No Active Exploit Signals
CVSS Base Score
6.8
MEDIUM
EPSS Probability:58.99%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| isc | bind | 9.9.8, 9.10.3 |
| suse | linux_enterprise_debuginfo | 11 |
| suse | manager | 2.1 |
| suse | manager_proxy | 2.1 |
| suse | openstack_cloud | 5 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 11.4, 13.1, 13.2 |
| suse | linux_enterprise_desktop | 11, 12 |
| suse | linux_enterprise_server | 11, 12 |
| suse | linux_enterprise_software_development_kit | 11, 12 |
| fedoraproject | fedora | 22, 23, 24 |
| canonical | ubuntu_linux | 12.04, 14.04, 15.10 |
| debian | debian_linux | 7.0, 8.0, 9.0 |
| juniper | junos | 12.1x46, 12.1x46-d10, 12.1x46-d76, 12.3x48, 15.1x49, 17.3, 17.4, 18.1, 18.2, 18.3, 18.4 |
| juniper | vsrx | all |
| juniper | srx100 | all |
| juniper | srx110 | all |
| juniper | srx1400 | all |
| juniper | srx1500 | all |
| juniper | srx1600 | all |
| juniper | srx210 | all |
| juniper | srx220 | all |
| juniper | srx2300 | all |
| juniper | srx240 | all |
| juniper | srx240h2 | all |
| juniper | srx240m | all |
| juniper | srx300 | all |
| juniper | srx320 | all |
| juniper | srx340 | all |
| juniper | srx3400 | all |
| juniper | srx345 | all |
| juniper | srx3600 | all |
| juniper | srx380 | all |
| juniper | srx4000 | all |
| juniper | srx4100 | all |
| juniper | srx4200 | all |
| juniper | srx4300 | all |
| juniper | srx4600 | all |
| juniper | srx4700 | all |
| juniper | srx5000 | all |
| juniper | srx5400 | all |
| juniper | srx550 | all |
| juniper | srx550_hm | all |
| juniper | srx550m | all |
| juniper | srx5600 | all |
| juniper | srx5800 | all |
| juniper | srx650 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
58.995%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2016-01-04T00:00:00 |
| Published | 2016-03-09T23:00:00 |
| Patch Date | 2016-03-09 |
| Last Updated | 2024-08-05T22:48:13 |
Community Chatter & Buzz