USN-3259-1: Bind vulnerabilities

Publication date

17 April 2017

Overview

Several security issues were fixed in Bind.


Packages

  • bind9 - Internet Domain Name Server

Details

It was discovered that the resolver in Bind made incorrect
assumptions about ordering when processing responses containing
a CNAME or DNAME. An attacker could use this cause a denial of
service. (CVE-2017-3137)

Oleg Gorokhov discovered that in some situations, Bind did not properly
handle DNS64 queries. An attacker could use this to cause a denial
of service. (CVE-2017-3136)

Mike Lalumiere discovered that in some situations, Bind did
not properly handle invalid operations requested via its control
channel. An attacker with access to the control channel could cause
a denial of service. (CVE-2017-3138)

It was discovered that the resolver in Bind made incorrect
assumptions about ordering when processing responses containing
a CNAME or DNAME. An attacker could use this cause a denial of
service. (CVE-2017-3137)

Oleg Gorokhov discovered that in some situations, Bind did not properly
handle DNS64 queries. An attacker could use this to cause a denial
of service. (CVE-2017-3136)

Mike Lalumiere discovered that in some situations, Bind did
not properly handle invalid operations requested via its control
channel. An attacker with access to the control channel could cause
a denial of service. (CVE-2017-3138)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
17.04 zesty bind9 –  1:9.10.3.dfsg.P4-10.1ubuntu5
16.10 yakkety bind9 –  1:9.10.3.dfsg.P4-10.1ubuntu1.6
16.04 xenial bind9 –  1:9.10.3.dfsg.P4-8ubuntu1.6
14.04 trusty bind9 –  1:9.9.5.dfsg-3ubuntu0.14
12.04 precise bind9 –  1:9.8.1.dfsg.P1-4ubuntu0.22

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›