CVE-2016-2776

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS

89.48% chance of exploitation in the next 30 days, 100th percentile

Published

2016-09-28

Updated

2024-08-05

Proof-of-concept exploits (4)

• KosukeShimofuji/CVE-2016-27760★ · 2016-09-28
• hack0ps/exploits0★ · 2017-01-04
• infobyte/CVE-2016-277627★ · 2016-10-03
• lmarqueta/exploits0★ · 2017-01-04

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tsig.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40453

References

• CVE Record
• NVD entry

Related

• CVE-2016-4861
• CVE-2016-5734
• CVE-2016-6662
• CVE-2016-8655
• CVE-2016-5195
• CVE-2021-21086