CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5679 – Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution
https://notcve.org/view.php?id=CVE-2023-5679
A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Una mala interacción entre DNS64 y el servidor obsoleto puede causar que "named" falle con una falla de aserción durante la resolución recursiva, cuando ambas funciones están habilitadas. Este problema afecta a las versiones de BIND 9, 9.16.12 a 9.16.45, 9.18.0 a 9.18.21, 9.19.0 a 9.19.19, 9.16.12-S1 a 9.16.45-S1 y 9.18.11-S1 a 9.18. .21-S1. A flaw was found in the bind package. This issue may allow an attacker to query in a DNS64 enabled resolver node with a domain name triggering a server-stale data, triggering a code assertion, and resulting in a crash of `named` processes. • http://www.openwall.com/lists/oss-security/2024/02/13/1 https://kb.isc.org/docs/cve-2023-5679 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ https://lists.fedoraproject.org/archives/list/package-announce@lists. • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5517 – Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled
https://notcve.org/view.php?id=CVE-2023-5517
A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Una falla en el código de manejo de consultas puede causar que `named` se cierre prematuramente con un error de aserción cuando: - `nxdomain-redirect ;` está configurado, y - el solucionador recibe una consulta PTR para una dirección RFC 1918 que normalmente dar como resultado una respuesta NXDOMAIN autorizada. Este problema afecta a las versiones de BIND 9, 9.12.0 a 9.16.45, 9.18.0 a 9.18.21, 9.19.0 a 9.19.19, 9.16.8-S1 a 9.16.45-S1 y 9.18.11-S1 a 9.18. .21-S1. A flaw was found in the bind package which may result in a Denial of Service in `named` process. This is a result of a reachable assertion, leading `named` to prematurely terminate when both conditions are met: nxdomain-redirect for the queried domain is configured and the resolver receives a PTR query, used for a reverse DNS lookup, for a RFC 1918 address that would normally result in an authoritative `NXDOMAIN` response. • http://www.openwall.com/lists/oss-security/2024/02/13/1 https://kb.isc.org/docs/cve-2023-5517 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ https://lists.fedoraproject.org/archives/list/package-announce@lists. • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4408 – Parsing large DNS messages may cause excessive CPU load
https://notcve.org/view.php?id=CVE-2023-4408
The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. El código de análisis de mensajes DNS en "named" incluye una sección cuya complejidad computacional es demasiado alta. No causa problemas para el tráfico DNS típico, pero las consultas y respuestas manipuladas pueden causar una carga excesiva de la CPU en la instancia "nombrada" afectada al explotar esta falla. • http://www.openwall.com/lists/oss-security/2024/02/13/1 https://kb.isc.org/docs/cve-2023-4408 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ https://lists.fedoraproject.org/archives/list/package-announce@lists. • CWE-400: Uncontrolled Resource Consumption •