CVE-2016-8864

What it actually does

A specially crafted DNAME record in the answer section of a DNS response to a recursive query triggers an assertion failure in db.c and resolver.c, causing the named daemon to exit immediately.

Why it matters to the business

Public or internal DNS resolvers can be taken offline with a single packet, interrupting name resolution for applications and users until the service is restarted; older unpatched deployments remain exposed years after disclosure.

How an attack unfolds

An unauthenticated remote attacker issues a recursive DNS query that elicits a response containing a DNAME record; processing of that record hits an assertion in the resolver path and terminates the daemon. No authentication or special positioning is required, and public exploits have not been observed in the wild.

How to fix it

Upgrade ISC BIND 9 to 9.9.9-P4, 9.10.4-P4, 9.11.0-P1 or later. Package maintainers should adopt the fixed versions supplied for task (Chainguard) 3.35.1-r1, task (Wolfi) 3.35.1-r1, and org/isc-projects/bind9 commit b7843f9794be456c53d7dc0b51ead89f2c5d3351. Where immediate patching is impossible, restrict recursive queries to trusted clients via ACLs or disable recursion on authoritative-only servers.

How to confirm the fix worked

Confirm named -v reports a version at or above the fixed releases; replay the original DNAME test vector in an isolated lab environment and verify the daemon no longer terminates; review change logs or package manifests for the listed commits or build identifiers.

Typical attack path

1. Attacker locates an exposed recursive resolver running an affected BIND 9 version.
2. Attacker sends a crafted recursive query designed to receive a DNAME-containing answer.
3. The resolver processes the DNAME record and hits the assertion failure.
4. named process exits, producing a denial of service until manual or automatic restart.

How to detect it

Search BIND query and daemon logs for repeated assertion failures or unexpected named process exits immediately following inbound recursive queries; correlate with network captures containing DNAME records in responses; review system crash dumps or journal entries around the same timestamp for named daemon terminations.

• assertion failure.*db.c
• assertion failure.*resolver.c
• named.*exiting.*DNAME

What your security team should do

• Prioritize upgrade of any internet-facing or internal recursive resolvers still running pre-9.9.9-P4 / 9.10.4-P4 / 9.11.0-P1 code.
• Implement query ACLs or disable recursion on authoritative servers that do not need it.
• Monitor BIND process uptime and assertion-failure logs; establish automated restart with rate limiting as a temporary control.
• Add the fixed package versions to internal SBOM and vulnerability scanning policies to prevent reintroduction.