[manjaro-security] [arch-security] [ASA-201706-18] bind: denial of service
rgacogne at archlinux.org
Thu Jun 15 19:58:30 CEST 2017
Arch Linux Security Advisory ASA-201706-18
Date : 2017-06-15
CVE-ID : CVE-2017-3140
Package : bind
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-301
The package bind before version 9.11.1.P1-1 is vulnerable to denial of
Upgrade to 9.11.1.P1-1.
# pacman -Syu "bind>=9.11.1.P1-1"
The problem has been fixed upstream in version 9.11.1.P1.
A security issue has been found the Bind named DNS server < 9.11.1P1,
leading to a denial of service. A remote attacker can make a vulnerable
server configured to use a RPZ containing NSDNAME or NSIPpolicy rules
enter an endless loop, querying the same sets of authoritative servers
repeatedly, by sending a crafted query.
A remote attacker can cause a denial of service of a vulnerable server
using NSDNAME or NSIP RPZ policies by sending a crafted query.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the manjaro-security