openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.

Versions of ISC BIND 9.x prior to 9.9.7-P3, 9.9.9-S3, 9.10.2-P4, and 9.10.3 are unpatched for the following vulnerabilities :

 - An assertion flaw exists that is triggered when parsing malformed DNSSEC keys.  With a specially crafted query to a zone containing such a key, a remote attacker can cause a validating resolver to exit.
 - A flaw exists in the 'fromwire_openpgpkey()' function in 'openpgpkey_61.c' that is triggered when the length of the data is less than 1.  With a specially crafted response to a query, a remote attacker can cause an assertion failure that terminates named.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.15. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists due to an     assertion flaw that is triggered when parsing malformed     DNSSEC keys. An unauthenticated, remote attacker can     exploit this, via a specially crafted query to a zone     containing such a key, to cause a validating resolver to     exit. (CVE-2015-5722)

  - A denial of service vulnerability exists in the     fromwire_openpgpkey() function in openpgpkey_61.c that     is triggered when the length of data is less than 1. An     unauthenticated, remote attacker can exploit this, via a     specially crafted response to a query, to cause an     assertion failure that terminates named. (CVE-2015-5986)

  - A flaw exists in the web service component due to HTTP     header field references missing from configuration files.
    A remote attacker can exploit this to bypass access     restrictions. (CVE-2015-7031)

The remote host is affected by the vulnerability described in GLSA-201510-01 (BIND: Denial of Service)

    A vulnerability has been discovered in BIND&rsquo;s named utility leading to       a Denial of Service condition.
  Impact :

    A remote attacker may be able to cause Denial of Service condition via       specially constructed zone data.
  Workaround :

    There is no known workaround at this time.

Fixed https://bugzilla.redhat.com/show_bug.cgi?id=1259563 https://bugzilla.redhat.com/show_bug.cgi?id=1259691

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query.

According to its self-reported version number, the installation of ISC BIND running on the remote name server is potentially affected by the following vulnerabilities :

  - A denial of service vulnerability exists due to an     assertion flaw that is triggered when parsing malformed     DNSSEC keys. An unauthenticated, remote attacker can     exploit this, via a specially crafted query to a zone     containing such a key, to cause a validating resolver to     exit. (CVE-2015-5722)

  - A denial of service vulnerability exists in the     fromwire_openpgpkey() function in openpgpkey_61.c that     is triggered when the length of data is less than 1. An     unauthenticated, remote attacker can exploit this, via a     specially crafted response to a query, to cause an     assertion failure that terminates named. (CVE-2015-5986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ISC reports :

An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query.

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

ID	Name	Product	Family	Severity
9866	ISC BIND 9.x < 9.9.7-P3 / 9.9.8 / 9.9.8-S1 / 9.9.8rc1 / 9.9.9-S3 / 9.10.2-P4 / 9.10.3 / 9.10.3rc1 Multiple DoS	Nessus Network Monitor	DNS Servers	high
86604	Mac OS X : OS X Server < 5.0.15 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
86435	GLSA-201510-01 : BIND: Denial of Service	Nessus	Gentoo Local Security Checks	high
86129	Fedora 22 : bind99-9.9.7-7.P3.fc22 (2015-14958)	Nessus	Fedora Local Security Checks	high
86015	F5 Networks BIG-IP : BIND vulnerability (SOL17227)	Nessus	F5 Networks Local Security Checks	high
85896	ISC BIND 9.0.x < 9.9.7-P3 / 9.10.x < 9.10.2-P4 Multiple DoS	Nessus	DNS	high
85831	Fedora 23 : bind99-9.9.7-7.P3.fc23 (2015-14954)	Nessus	Fedora Local Security Checks	high
85775	FreeBSD : bind -- denial of service vulnerability (2c5e7e23-5248-11e5-9ad8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
85746	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-245-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2015-5986

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high