Description
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.10.3.dfsg.P4-6 | — |
| Debian 13 | bind9 | 1:9.10.3.dfsg.P4-6 | — |
| Debian 12 | bind9 | 1:9.10.3.dfsg.P4-6 | — |
| Debian 8 | bind9 | 1:9.9.5.dfsg-9+deb8u6 | DSA-3511-1 |
| Debian 7 | bind9 | 1:9.8.4.dfsg.P1-6+nmu2+deb7u10 | DSA-3511-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.8 | USN-2925-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | bind +13 | 32:9.9.4-29.el7_2.3 | RHSA-2016:0459 |
| RHEL 6 | bind +5 | 32:9.8.2-0.37.rc1.el6_7.7 | RHSA-2016:0459 |
| RHEL 5 | bind +7 | 30:9.3.6-25.P1.el5_11.8 | RHSA-2016:0459 |
| RHEL 5 | bind97 +4 | 32:9.7.0-21.P2.el5_11.6 | RHSA-2016:0458 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | bind +5 | 32:9.7.3-8.P3.el6_2.4 | RHSA-2016:0601 |
| RHEL 6.6 EUS | bind +5 | 32:9.8.2-0.30.rc1.el6_6.5 | RHSA-2016:0562 |
| RHEL 6.5 AUS | bind +5 | 32:9.8.2-0.23.rc1.el6_5.3 | RHSA-2016:0562 |
| RHEL 6.4 AUS | bind +5 | 32:9.8.2-0.17.rc1.el6_4.8 | RHSA-2016:0562 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | bind | 9.9.6P1-38.1 | SUSE-SU-2016:0759-1 |
| SLES 12 | bind | 9.9.6P1-28.12.1 | SUSE-SU-2016:0780-1 |
| SLES 11 SP4 | bind | 9.9.6P1-0.25.1 | SUSE-SU-2016:0825-1 |
| SLES 11 SP3 | bind | 9.9.6P1-0.25.1 | SUSE-SU-2016:0825-1 |
| SLES 11 SP2 | bind | 9.9.6P1-0.25.1 | SUSE-SU-2016:0825-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | bind | 9.9.6P1-38.1 | SUSE-SU-2016:0759-1 |
| SLES for SAP 12 | bind | 9.9.6P1-28.12.1 | SUSE-SU-2016:0780-1 |
| SLES for SAP 11 SP4 | bind | 9.9.6P1-0.25.1 | SUSE-SU-2016:0825-1 |
| SUSE OpenStack Cloud 5 | bind | 9.9.6P1-0.27.1 | SUSE-SU-2016:1541-1 |
| SUSE Manager Proxy 2.1 | bind | 9.9.6P1-0.27.1 | SUSE-SU-2016:1541-1 |
| SUSE Manager 2.1 | bind | 9.9.6P1-0.27.1 | SUSE-SU-2016:1541-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | bind +13 | 32:9.9.4-29.el7_2.3 | ELSA-2016-0459 |
| Oracle Linux 7 | bind-libbind-devel +1 | 30:9.3.6-25.P1.el5_11.8 | ELSA-2016-0459 |
Advisories 13
- RHSA-2016:0459 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2016:0562 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2016:0601 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2925-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3511-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:1541-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0759-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0780-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0825-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2016:0458 Red Hat Security Advisory: bind97 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2025-1185 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 29, 2025
- ELSA-2016-0459 Important: bind security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 16, 2016
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- FEDORA-2016-5047abe4a9 vendor-advisory
- DSA-3511 vendor-advisory
- SUSE-SU-2016:0780 vendor-advisory
- FreeBSD-SA-16:13 vendor-advisory
- https://kb.isc.org/article/AA-01438
- USN-2925-1 vendor-advisory
- https://kb.isc.org/article/AA-01352
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- RHSA-2016:0562 vendor-advisory
- openSUSE-SU-2016:0830 vendor-advisory
- GLSA-201610-07 vendor-advisory
- 1035236 vdb-entry
- SUSE-SU-2016:1541 vendor-advisory
- FEDORA-2016-364c0a9df4 vendor-advisory
- openSUSE-SU-2016:0834 vendor-advisory
- HPSBUX03583 vendor-advisory
- SUSE-SU-2016:0759 vendor-advisory
- https://kb.isc.org/article/AA-01380
- FEDORA-2016-dce6dbe6a8 vendor-advisory
- FEDORA-2016-b593e84223 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05087821
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- SUSE-SU-2016:0825 vendor-advisory
- RHSA-2016:0601 vendor-advisory
- openSUSE-SU-2016:0859 vendor-advisory
- FEDORA-2016-161b73fc2c vendor-advisory
- openSUSE-SU-2016:0827 vendor-advisory
- FEDORA-2016-75f31fbb0a vendor-advisory