CVE-2016-2848

critical-risk

Published 2016-10-21

ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.

Do I need to act?

51.3% chance of exploitation in next 30 days

EPSS score — higher than 49% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Bind

Affected Vendors

Isc

References (22)

http://rhn.redhat.com/errata/RHSA-2016-2093.html

http://rhn.redhat.com/errata/RHSA-2016-2094.html

http://rhn.redhat.com/errata/RHSA-2016-2099.html

http://www.securityfocus.com/bid/93809

http://www.securityfocus.com/bid/93814

http://www.securitytracker.com/id/1037073

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1385450

Mitigation https://kb.isc.org/article/AA-01433/74/CVE-2016-2848

https://security.netapp.com/advisory/ntap-20180926-0002/

https://security.netapp.com/advisory/ntap-20180926-0005/

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git%3Ba=commit%3Bh=4adf97c32fc...

http://rhn.redhat.com/errata/RHSA-2016-2093.html

http://rhn.redhat.com/errata/RHSA-2016-2094.html

http://rhn.redhat.com/errata/RHSA-2016-2099.html

http://www.securityfocus.com/bid/93809

http://www.securityfocus.com/bid/93814

http://www.securitytracker.com/id/1037073

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1385450

Mitigation https://kb.isc.org/article/AA-01433/74/CVE-2016-2848

https://security.netapp.com/advisory/ntap-20180926-0002/

and 2 more references

/ 100

critical-risk

Severity 26/34 · High

Exploitability 18/34 · Moderate

Exposure 33/34 · Critical