USN-3259-1: Bind vulnerabilities

Ubuntu Security Notice USN-3259-1

17th April, 2017

bind9 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 17.04



• Ubuntu 16.10



• Ubuntu 16.04 LTS



• Ubuntu 14.04 LTS



• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Bind.

Software description

• bind9
  - Internet Domain Name Server
  
  

Details

It was discovered that the resolver in Bind made incorrect
assumptions about ordering when processing responses containing
a CNAME or DNAME. An attacker could use this cause a denial of
service. ()

Mike Lalumiere discovered that in some situations, Bind did
not properly handle invalid operations requested via its control
channel. An attacker with access to the control channel could cause
a denial of service. (









.

In general, a standard system update will make all the necessary changes.

References

,

CVE-2017-3138