Skip to content
CVE Tracker
Back

CVE-2016-9778

An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c

High7.5EPSS 6.8%
Published
Updated
Reserved
Assigned by
isc

Description

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the "nxdomain-redirect" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type "redirect" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.

Scores

CVSS scores of CVE-2016-9778, by who scored it
Scored byCVSSScoreVector
iscCNA (assigner)3.0High7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Modified3.0Medium5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
6.8% · top 6.0% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

  • Only servers which are performing NXDOMAIN redirection using the "nxdomain-redirect" function are potentially vulnerable and then only a subset of those servers. In order to be affected a server must be using nxdomain-redirect AND must be redirecting NXDOMAIN responses for a zone for which the server also provides authoritative service -- therefore a purely recursive server is not at risk, either. Successful exploitation of the vulnerability will cause named to stop execution after encountering a REQUIRE assertion failure in db.c, resulting in denial of service to clients.
  • CWE-388 (opens in a new tab)

Affected products

  • ISC · BIND 9

    • affected BIND 9 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1

What to do

Solution: Upgrade to the patched release most closely related to your current version of BIND. These can be downloaded from http://www.isc.org/downloads. BIND 9 version 9.11.0-P2 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9.9.9-S7

Workaround: Either provide an ordinary (that is: not redirected) NXDOMAIN for non-existent resource records in zones for which authoritative data is served on the same server or use redirect zones instead of the nxdomain-redirect feature.

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .