CVE-2016-8864 ISC BIND DNAME Answer Response Handling Denial of Service Vulnerability (AA-01434)

ISC BIND is open source software that implements the Domain Name System (DNS) protocols for the Internet.

The vulnerability exists because of an assertion failure in db.c or resolver.c source files implemented in the affected versions. While processing a recursive response containing a DNAME record in the answer section, BIND can stop execution after encountering an assertion error in resolver.c (error message: "INSIST((valoptions & 0x0002U) != 0) failed") or db.c (error message: "REQUIRE(targetp != ((void *)0) && *targetp == ((void *)0)) failed").

Affected Versions:
ISC BIND versions 9.0.x through 9.8.x
ISC BIND versions 9.9.0 through 9.9.9-P3
ISC BIND versions 9.9.3-S1 through 9.9.9-S5
ISC BIND versions 9.10.0 through 9.10.4-P3
ISC BIND version 9.11.0

Successful exploitation allows an attacker to cause a denial of service condition on the targeted server.

Customers are advised to install BIND 9 versions 9.9.9-P4, 9.10.4-P4, 9.11.0-P1 or later to remediate this vulnerability.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ISC BIND 9 9.9.9-P4, 9.10.4-P4, 9.11.0-P1 or later