PT-2023-21641 · Isc+1 · Bind 9+1

Published 2023-06-21 · Updated 2024-02-13 · CVE-2023-2829

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.16.8-S1 through 9.16.41-S1 BIND 9 versions 9.18.11-S1 through 9.18.15-S1

Description A named instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (synth-from-dnssec) enabled can be remotely terminated using a zone with a malformed NSEC record.

Recommendations For BIND 9 versions 9.16.8-S1 through 9.16.41-S1, consider disabling the synth-from-dnssec option until a patch is available. For BIND 9 versions 9.18.11-S1 through 9.18.15-S1, consider disabling the synth-from-dnssec option until a patch is available. As a temporary workaround, restrict the use of the named instance as a DNSSEC-validating recursive resolver to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2024-1988

AZL-27305

CVE-2023-2829

Affected Products

Alt Linux

Bind 9

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-2829 · Security Note
• https://osv.dev/vulnerability/AZL-27305 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2829 · Vendor Advisory
• https://kb.isc.org/docs/cve-2023-2829 · Vendor Advisory
• https://t.me/cvenotify/52801 · Telegram Post
• https://t.me/true_secator/4544 · Telegram Post
• https://t.me/cvenotify/53570 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230703-0010 · Note
• https://t.me/cvenotify/52821 · Telegram Post