High-severity vulnerabilities patched in popular domain name software BIND
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-2828 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authori Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. NVD description · AI analysis pending | 7.5 | 4% |
| — |
Full article225 words · extracted from therecord.media · click to collapse
The Internet Systems Consortium (ISC) has released patches to address security vulnerabilities affecting multiple versions of BIND 9, a widely used open-source software package that provides internet domain name system services. With the recently discovered vulnerabilities remote attackers could launch denial-of-service attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory released Friday. BIND stands for Berkeley Internet Name Domain. The list of the bugs patched by ISC includes CVE-2023-2828, CVE-2023-2829, and CVE-2023-2911. These vulnerabilities can be exploited remotely, and according to the common vulnerability scoring system, they have a severity rating of 7.5 out of 10. Their successful exploitation could exhaust all available memory on a target server, making it unavailable. ISC, a nonprofit corporation, said that there is no evidence that any of these vulnerabilities are being exploited, but it recommended BIND users to upgrade software to the latest version to mitigate potential threats. BIND is the most commonly deployed DNS server software. It is used by major financial institutions, universities, manufacturers, and government organizations, according to ISC, which maintains and distributes the software. BIND helps translate human-readable domain names into IP addresses and vice versa. It works on different operating systems and is essential for reliable internet communication. Back in January, ISC addressed similar security vulnerabilities that could also lead to denial-of-service conditions and BIND system failures.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/bind-9-patches-internet-dns-vulnerabilities