USN-2925-1 Bind9 vulnerabilities
Severity
Medium
Vendor
Ubuntu, Bind9
Versions Affected
- Ubuntu 14.04 LTS
Description
Bind could be made to crash if it received specially crafted network traffic.
It was discovered that Bind incorrectly handled input received by the rndc control channel. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1285)
It was discovered that Bind incorrectly parsed resource record signatures for DNAME resource records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1286)
Affected VMware Products and Versions
Severity is medium unless otherwise noted.
- All versions of Cloud Foundry rootfs prior to 1.43.0 AND stemcell 3146.x versions prior to 3146.10 AND all other stemcell versions prior to 3215
- Pivotal Redis 1.4.x versions prior to 1.4.21 AND 1.5.x versions prior to 1.5.10
- Pivotal Ops Manager 1.5.x versions prior to 1.5.17 AND 1.6.x versions prior to 1.6.12
- Pivotal Elastic Runtime 1.5.x versions prior to 1.5.17 AND 1.6.x versions prior to 1.6.18
- Pivotal RabbitMQ 1.5.x versions prior to 1.5.8
- Pivotal Push Notification Service 1.4.x versions prior to 1.4.3
- Pivotal Ops Metrics 1.6.x versions prior to 1.6.10
- Pivotal Single Sign On 1.0.x versions prior to 1.0.10
- Pivotal Spring Cloud Services 1.0.x versions prior to 1.0.7
- Pivotal MySQL 1.6.x versions prior to 1.6.9 AND 1.7.x versions prior to 1.7.6 AND edge release versions prior to 1.8.0-edge.3
Mitigation
Users of affected versions should apply the following mitigation:
- The Cloud Foundry project recommends that Cloud Foundry deployments upgrade rootfs to version 1.43.0 or later
- The Cloud Foundry project recommends that Cloud Foundry deployments upgrade stemcell versions 3146.x to 3146.10 or later OR all other stemcell versions to 3215 or later
- Upgrade Pivotal Redis 1.4.x versions to 1.4.21 or later OR 1.5.x versions to 1.5.10 or later
- Upgrade Pivotal Ops Manager 1.5.x versions to 1.5.17 or later OR 1.6.x versions to 1.6.12 or later
- Upgrade Pivotal Elastic Runtime 1.5.x versions to 1.5.17 or later OR 1.6.x versions to 1.6.18 or later
- Upgrade Pivotal RabbitMQ 1.5.x versions to 1.5.8 or later
- Upgrade Pivotal Push Notification Service 1.4.x versions to 1.4.3 or later
- Upgrade Pivotal Ops Metrics 1.6.x versions to 1.6.10 or later
- Upgrade Pivotal Single Sign On 1.0.x versions to 1.0.10 or later
- Upgrade Pivotal Spring Cloud Services 1.0.x versions to 1.0.7 or later
- Upgrade Pivotal MySQL to 1.6.9 or later 1.6.x versions OR 1.7.x versions to 1.7.6 or later OR edge versions 1.8.0-edge.3 or later
Credit
None