CVE-2016-1285: ISC BIND DNAME parsing flaw crashes named via rndc channel

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated crash of a core DNS daemon with a high EPSS score, though no KEV listing or known exploit reference is present.

What it is

ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 mishandle DNAME records while parsing fetch reply messages, causing an assertion failure and daemon exit. The flaw is reachable through the rndc control channel, so a malformed packet can take down the name server.

Impact

An attacker can crash the named daemon, causing a denial of service for DNS resolution served by that instance. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reached remotely over the network via the rndc (control channel) interface, per the description and the AV:N vector. No authentication or user interaction is required according to the CVSS vector (PR:N, UI:N), though the record does not detail how rndc access is configured in practice.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at 0.59143 (99th percentile), indicating elevated predicted exploitation likelihood. Reference tags are advisory and mailing-list entries only, with no public exploit reference supplied.

What to do

• Upgrade BIND to 9.9.8-P4, 9.10.3-P4 or later, or apply the vendor patch for your distribution.
• Restrict rndc control channel access to trusted management hosts using rndc key authentication and firewall rules.
• Disable or bind the control channel to loopback where remote rndc management is not required.
• Monitor vendor advisories (ISC, Red Hat, Debian, Ubuntu, SUSE, Fedora) for the corresponding fixed packages.

Detection

• Alert on named process exits or restarts with assertion failures referencing alist.c or sexpr.c.
• Monitor rndc control channel connections for unexpected or untrusted source addresses.
• Correlate DNS service outages with control-channel traffic in firewall and host logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.