Description
resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 2
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1185 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 29, 2025
References
- 1035238 vdb-entry
- 84290 vdb-entry
- GLSA-201610-07 vendor-advisory
- FEDORA-2016-364c0a9df4 vendor-advisory
- https://kb.isc.org/article/AA-01380
- https://kb.isc.org/article/AA-01351
- FEDORA-2016-b593e84223 vendor-advisory
- FEDORA-2016-75f31fbb0a vendor-advisory