CVE-2016-8864

high · 7.5

named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.

7.5

CVSS

38.7%

EPSS (exploit prob.)

99th

EPSS percentile

2016-11-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-617

Affected products

Vendor	Product	Affected versions
isc	bind	>= 9.0.0, < 9.9.9
isc	bind	>= 9.10.0, < 9.10.4
isc	bind	9.9.9
isc	bind	9.9.9
isc	bind	9.9.9
isc	bind	9.9.9
isc	bind	9.9.9
isc	bind	9.9.9
isc	bind	9.10.4
isc	bind	9.10.4
isc	bind	9.10.4
isc	bind	9.10.4
isc	bind	9.10.4
isc	bind	9.10.4
isc	bind	9.10.4
isc	bind	9.11.0
isc	bind	9.11.0
isc	bind	9.11.0
isc	bind	9.11.0
isc	bind	9.11.0
isc	bind	9.11.0
isc	bind	9.11.0
netapp	data_ontap_edge	all versions
netapp	solidfire	all versions
netapp	steelstore_cloud_integrated_storage	all versions
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_desktop	7.0
redhat	enterprise_linux_eus	6.7
redhat	enterprise_linux_eus	7.2
redhat	enterprise_linux_eus	7.3
redhat	enterprise_linux_eus	7.4
redhat	enterprise_linux_eus	7.5
redhat	enterprise_linux_eus	7.6
redhat	enterprise_linux_eus	7.7
redhat	enterprise_linux_server	5.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server	7.0
redhat	enterprise_linux_server_aus	6.2
redhat	enterprise_linux_server_aus	6.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-8864