CVE-2016-6170

Name	CVE-2016-6170
Description	ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)
Debian Bugs	830810

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bind9 (PTS)	jessie	1:9.9.5.dfsg-9+deb8u15	vulnerable
	jessie (security)	1:9.9.5.dfsg-9+deb8u18	vulnerable
	stretch	1:9.10.3.dfsg.P4-12.3+deb9u4	vulnerable
	stretch (security)	1:9.10.3.dfsg.P4-12.3+deb9u5	vulnerable
	bullseye, sid, buster	1:9.11.5.P4+dfsg-5.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
bind9	source	(unstable)	1:9.10.6+dfsg-1	unimportant		830810

Notes

Not fixed upstream, proposed patches below are unofficial:
Fixed by https://github.com/sischkg/xfer-limit/blob/master/bind-9.10.3-xfer-limit-0.0.1.patch
Fixed by https://github.com/sischkg/xfer-limit/blob/master/bind-9.9.9-P1-xfer-limit-0.0.1.patch
Negligible security impact