[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a8099639-6200-2e90-f14c-415791387826@isc.org>
Date: Mon, 18 Jul 2016 19:42:17 -0800
From: Michael McNally <mcnally@....org>
To: oss-security@...ts.openwall.com
Subject: ISC security issue CVE-2016-2775 (potential denial-of-service attack
against lwres functionality in BIND)
Earlier today ISC disclosed a vulnerability affecting BIND (specifically
affecting lightweight resolution functionality in BIND, NOT normal DNS
resolution. The bug affects the lwresd program or named if is configured
to do lightweight resolution using the "lwres" configuration statement.)
The defect was publicly disclosed as CVE-2016-2775 and the official
vulnerability disclosure is here:
https://kb.isc.org/article/AA-01393/74/CVE-2016-2775
Ordinarily we try to give advance notice to packagers when we are
preparing new releases of BIND. Unfortunately our timetable for this
incident changed in mid-course when the reporting party informed us
that reproduction code was already available in a public bug repository.
We apologize for the inconvenience caused by the acceleration of our
disclosure timetable.
New releases of BIND are available which fix the lwres issue
(CVE-2016-2775) and include fixes for a few regressions which
had been introduced in recent versions. You can find them in
the usual place on our site:
https://www.isc.org/downloads
A standalone patch diff addressing only CVE-2016-2775 can be made
available upon request to any parties who want only the lwres CVE
fix and not the other regression fixes. Contact security-officer@....org
if you wish to request it.
Michael McNally
(for ISC Security Officer)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
