svn commit: r419979 - head/security/vuxml
Jason Unovitch
junovitch at FreeBSD.org
Wed Aug 10 01:27:46 UTC 2016
Author: junovitch
Date: Wed Aug 10 01:27:44 2016
New Revision: 419979
URL: https://svnweb.freebsd.org/changeset/ports/419979
Log:
Document denial of service vector via oversized AXFR, IXFR, or Dynamic DNS
updates in BIND, Knot, NSD, and PowerDNS
Security: CVE-2016-6170
Security: CVE-2016-6171
Security: CVE-2016-6172
Security: CVE-2016-6173
Security: https://vuxml.FreeBSD.org/freebsd/7d08e608-5e95-11e6-b334-002590263bf5.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Wed Aug 10 00:19:04 2016 (r419978)
+++ head/security/vuxml/vuln.xml Wed Aug 10 01:27:44 2016 (r419979)
@@ -58,6 +58,73 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="7d08e608-5e95-11e6-b334-002590263bf5">
+ <topic>BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers</topic>
+ <affects>
+ <package>
+ <name>bind99</name>
+ <range><le>9.9.9P2</le></range>
+ </package>
+ <package>
+ <name>bind910</name>
+ <range><le>9.10.4P2</le></range>
+ </package>
+ <package>
+ <name>bind911</name>
+ <range><le>9.11.0.b2</le></range>
+ </package>
+ <package>
+ <name>bind9-devel</name>
+ <range><ge>0</ge></range>
+ </package>
+ <package>
+ <name>knot</name>
+ <name>knot1</name>
+ <range><lt>1.6.8</lt></range>
+ </package>
+ <package>
+ <name>knot2</name>
+ <range><lt>2.3.0</lt></range>
+ </package>
+ <package>
+ <name>nsd</name>
+ <range><lt>4.1.11</lt></range>
+ </package>
+ <package>
+ <name>powerdns</name>
+ <range><lt>4.0.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>ISC reports:</p>
+ <blockquote cite="https://kb.isc.org/article/AA-01390">
+ <p>DNS protocols were designed with the assumption that a certain
+ amount of trust could be presumed between the operators of primary
+ and secondary servers for a given zone. However, in current
+ practice some organizations have scenarios which require them to
+ accept zone data from sources that are not fully trusted (for
+ example: providers of secondary name service). A party who is
+ allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS
+ updates) can overwhelm the server which is accepting data by
+ intentionally or accidentally exhausting that server's memory.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-6170</cvename>
+ <cvename>CVE-2016-6171</cvename>
+ <cvename>CVE-2016-6172</cvename>
+ <cvename>CVE-2016-6173</cvename>
+ <url>https://kb.isc.org/article/AA-01390</url>
+ <mlist>http://www.openwall.com/lists/oss-security/2016/07/06/4</mlist>
+ </references>
+ <dates>
+ <discovery>2016-07-06</discovery>
+ <entry>2016-08-10</entry>
+ </dates>
+ </vuln>
+
<vuln vid="dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in sctp(4)</topic>
<affects>
More information about the svn-ports-all
mailing list