[manjaro-security] [ASA-202110-12] bind: denial of service
Jonas Witschel via arch-security
arch-security at lists.archlinux.org
Mon Nov 1 12:38:29 CET 2021
Arch Linux Security Advisory ASA-202110-12
Date : 2021-10-29
CVE-ID : CVE-2021-25219
Package : bind
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-2502
The package bind before version 9.16.22-1 is vulnerable to denial of
Upgrade to 9.16.22-1.
# pacman -Syu "bind>=9.16.22-1"
The problem has been fixed upstream in version 9.16.22.
Setting "lame-ttl 0;" in the BIND configuration prevents the
In BIND before version 9.16.22, exploitation of broken authoritative
servers using a flaw in response processing can cause degradation in
BIND resolver performance. The way the lame cache is currently designed
makes it possible for its internal data structures to grow almost
infinitely, which may cause significant delays in client query
A malicious DNS client could trigger queries to broken authoritative
DNS servers, resulting in high CPU usage and service degradation of the
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security