Alerts This Week
Warning Icon 1 535
Alerts This Week
Warning Icon 1 535

Mageia: 2020-0259 Moderate: Bind Denial of Service Issues

mageia
Calendar Grey June 15, 2020
Dist Mageia Esm H88
Recent updates to bind packages from Mageia tackle multiple security vulnerabilities, addressing concerns such as denial of service threats and excessive resource consumption.
Updated bind packages fix security vulnerabilities: It was discovered that Bind incorrectly handled certain TCP-pipelined queries

Summary

Updated bind packages fix security vulnerabilities:
It was discovered that Bind incorrectly handled certain TCP-pipelined queries. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service (CVE-2019-6477).
Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Bind incorrectly limited certain fetches. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service, or possibly use Bind to perform a reflection attack (CVE-2020-8616).
Tobias Klein discovered that Bind incorrectly handled checking TSIG validity. A remote attacker could use this issue to cause Bind to crash, resulting in a denial of service, or possibly perform other attacks (CVE-2020-8617).

References

- https://bugs.mageia.org/show_bug.cgi?id=25724

- https://kb.isc.org/docs/cve-2019-6477

- https://kb.isc.org/docs/cve-2020-8616

- https://kb.isc.org/docs/cve-2020-8617

- https://ubuntu.com/security/notices/USN-4197-1

- https://ubuntu.com/security/notices/USN-4365-1

- https://www.cve.org/CVERecord?id=CVE-2019-6477

- https://www.cve.org/CVERecord?id=CVE-2020-8616

- https://www.cve.org/CVERecord?id=CVE-2020-8617

Resolution

SRPMS

- 7/core/bind-9.11.6-1.1.mga7

Publication date: 15 Jun 2020
URL: https://advisories.mageia.org/MGASA-2020-0259.html
Type: security
CVE: CVE-2019-6477, CVE-2020-8616, CVE-2020-8617

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here