USN-2925-1 Bind9 vulnerabilities


Severity

Medium

Vendor

Ubuntu, Bind9

Versions Affected
  • Ubuntu 14.04 LTS
Description

Bind could be made to crash if it received specially crafted network traffic.

It was discovered that Bind incorrectly handled input received by the rndc control channel. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1285)

It was discovered that Bind incorrectly parsed resource record signatures for DNAME resource records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1286)

Affected Pivotal Products and Versions

Severity is medium unless otherwise noted.

  • All versions of Cloud Foundry rootfs prior to 1.43.0 AND stemcell 3146.x versions prior to 3146.10 AND all other stemcell versions prior to 3215
  • Pivotal Redis 1.4.x versions prior to 1.4.21 AND 1.5.x versions prior to 1.5.10
  • Pivotal Ops Manager 1.5.x versions prior to 1.5.17 AND 1.6.x versions prior to 1.6.12
  • Pivotal Elastic Runtime 1.5.x versions prior to 1.5.17 AND 1.6.x versions prior to 1.6.18
  • Pivotal RabbitMQ 1.5.x versions prior to 1.5.8
  • Pivotal Push Notification Service 1.4.x versions prior to 1.4.3
  • Pivotal Ops Metrics 1.6.x versions prior to 1.6.10
  • Pivotal Single Sign On 1.0.x versions prior to 1.0.10
  • Pivotal Spring Cloud Services 1.0.x versions prior to 1.0.7
  • Pivotal MySQL 1.6.x versions prior to 1.6.9 AND 1.7.x versions prior to 1.7.6 AND edge release versions prior to 1.8.0-edge.3
Mitigation

Users of affected versions should apply the following mitigation:

  • The Cloud Foundry project recommends that Cloud Foundry deployments upgrade rootfs to version 1.43.0 or later
  • The Cloud Foundry project recommends that Cloud Foundry deployments upgrade stemcell versions 3146.x to 3146.10 or later OR all other stemcell versions to 3215 or later
  • Upgrade Pivotal Redis 1.4.x versions to 1.4.21 or later OR 1.5.x versions to 1.5.10 or later
  • Upgrade Pivotal Ops Manager 1.5.x versions to 1.5.17 or later OR 1.6.x versions to 1.6.12 or later
  • Upgrade Pivotal Elastic Runtime 1.5.x versions to 1.5.17 or later OR 1.6.x versions to 1.6.18 or later
  • Upgrade Pivotal RabbitMQ 1.5.x versions to 1.5.8 or later
  • Upgrade Pivotal Push Notification Service 1.4.x versions to 1.4.3 or later
  • Upgrade Pivotal Ops Metrics 1.6.x versions to 1.6.10 or later
  • Upgrade Pivotal Single Sign On 1.0.x versions to 1.0.10 or later
  • Upgrade Pivotal Spring Cloud Services 1.0.x versions to 1.0.7 or later
  • Upgrade Pivotal MySQL to 1.6.9 or later 1.6.x versions OR 1.7.x versions to 1.7.6 or later OR edge versions 1.8.0-edge.3 or later
Credit

None

References