Jared Mauch reported a denial of service flaw in the way BIND, a DNS server, handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash.

For the stable distribution (wheezy), this problem has been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u2. For the testing distribution (jessie), this problem has been fixed in version 1:9.9.5.dfsg-2. For the unstable distribution (sid), this problem has been fixed in version 1:9.9.5.dfsg-2. We recommend that you upgrade your bind9 packages.

The Berkeley Internet Name Domain (BIND) implements an Internet domain name server. BIND is the most widely-used name server software on the Internet, and is supported by the Internet Software Consortium, www.isc.org. This package provides the server and related configuration files.

bind9 on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2014/dsa-3023.html

---

Updated on 2015-03-25