PT-2024-1751 · Isc+16 · Isc Bind+17
Petr Špaček
·
Published
2024-02-13
·
Updated
2025-12-23
·
CVE-2023-50868
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Vulnerability Report
Name of the Vulnerable Software and Affected Versions
- BIND versions 9.16.48-1 through 9.18.24-1
- Unbound versions 1.19.1-alt1
- PDNS Recursor versions 4.8.6-1
- Knot Resolver versions 5.6.0-1+deb12u1
- systemd (affected versions not specified)
- dnsmasq (affected versions not specified)
- COBALT (affected versions not specified)
Description
Multiple vulnerabilities have been discovered in various DNS server implementations, including BIND, Unbound, PDNS Recursor, and Knot Resolver. A denial-of-service (DoS) vulnerability exists in BIND due to a flaw in query-handling code and a CPU exhaustion issue related to malformed DNSSEC records. A similar CPU exhaustion vulnerability affects DNSSEC-validating resolvers when processing specially crafted DNSSEC responses. Additionally, vulnerabilities have been identified in systemd, dnsmasq, and COBALT, though specific details are limited. A publicly disclosed vulnerability (CVE-2023-50868) exists in Microsoft DNS servers, impacting DNSSEC validation.
Recommendations
- Upgrade BIND to version 9.16.48-1 or 9.18.24-1.
- Upgrade Unbound to version 1.19.1-alt1.
- Upgrade PDNS Recursor to version 4.8.6-1.
- Upgrade Knot Resolver to version 5.6.0-1+deb12u1.
- Upgrade systemd to the latest available version.
- Upgrade dnsmasq to the latest available version.
- Upgrade COBALT to the latest available version.
- For systems using DNSSEC validation, consider upgrading to a version that addresses the NSEC3 processing issue.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Bind Server
Centos
Debian
Freebsd
Ibm Aix
Isc Bind
Linuxmint
Dns
Powerdns Recursor
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Windows