7.8

CVE-2016-2776

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Linux Version5.0
Oracle ≫ Linux Version6
Oracle ≫ Linux Version7
Oracle ≫ Vm Server Version3.2
Oracle ≫ Vm Server Version3.3
Oracle ≫ Vm Server Version3.4
Isc ≫ Bind Updatep3 Version <= 9.9.9
Isc ≫ Bind Version9.10.0
Isc ≫ Bind Version9.10.0 Updatea1
Isc ≫ Bind Version9.10.0 Updatea2
Isc ≫ Bind Version9.10.0 Updateb1
Isc ≫ Bind Version9.10.0 Updateb2
Isc ≫ Bind Version9.10.0 Updatep1
Isc ≫ Bind Version9.10.0 Updatep2
Isc ≫ Bind Version9.10.0 Updaterc1
Isc ≫ Bind Version9.10.0 Updaterc2
Isc ≫ Bind Version9.10.1
Isc ≫ Bind Version9.10.1 Updateb1
Isc ≫ Bind Version9.10.1 Updateb2
Isc ≫ Bind Version9.10.1 Updatep1
Isc ≫ Bind Version9.10.1 Updatep2
Isc ≫ Bind Version9.10.1 Updaterc1
Isc ≫ Bind Version9.10.1 Updaterc2
Isc ≫ Bind Version9.10.2 Updateb1
Isc ≫ Bind Version9.10.2 Updatep1
Isc ≫ Bind Version9.10.2 Updatep2
Isc ≫ Bind Version9.10.2 Updatep3
Isc ≫ Bind Version9.10.2 Updatep4
Isc ≫ Bind Version9.10.2 Updaterc1
Isc ≫ Bind Version9.10.2 Updaterc2
Isc ≫ Bind Version9.10.3
Isc ≫ Bind Version9.10.3 Updateb1
Isc ≫ Bind Version9.10.3 Updatep1
Isc ≫ Bind Version9.10.3 Updatep2
Isc ≫ Bind Version9.10.3 Updatep3
Isc ≫ Bind Version9.10.3 Updatep4
Isc ≫ Bind Version9.10.3 Updaterc1
Isc ≫ Bind Version9.10.4 Updatep2
Isc ≫ Bind Version9.10.4 Updatep3
Isc ≫ Bind Version9.11.0 Updatea1
Isc ≫ Bind Version9.11.0 Updatea2
Isc ≫ Bind Version9.11.0 Updatea3
Isc ≫ Bind Version9.11.0 Updateb1
Isc ≫ Bind Version9.11.0 Updateb2
Isc ≫ Bind Version9.11.0 Updateb3
Isc ≫ Bind Version9.11.0 Updaterc1
Hp ≫ Hp-ux Version11.31
Oracle ≫ Solaris Version10.0
Oracle ≫ Solaris Version11.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 89.48% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Third Party Advisory
https://kb.isc.org/article/AA-01438
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
Third Party Advisory
https://security.gentoo.org/glsa/201610-07
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05321107
Third Party Advisory
https://kb.isc.org/article/AA-01435
https://kb.isc.org/article/AA-01436
http://rhn.redhat.com/errata/RHSA-2016-1944.html
http://rhn.redhat.com/errata/RHSA-2016-1945.html
http://rhn.redhat.com/errata/RHSA-2016-2099.html
http://www.securityfocus.com/bid/93188
http://www.securitytracker.com/id/1036903
https://kb.isc.org/article/AA-01419/0
Vendor Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:28.bind.asc
https://security.netapp.com/advisory/ntap-20160930-0001/
https://www.exploit-db.com/exploits/40453/