PT-2024-3867 · Isc · Bind

Published 2024-02-13 · Updated 2024-10-22 · CVE-2023-5680

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions BIND versions 9.11.3-S1 through 9.11.37-S1 BIND versions 9.16.8-S1 through 9.16.45-S1 BIND versions 9.18.11-S1 through 9.18.21-S1

Description The issue is related to the EDNS Client Subnet (ECS) component of the BIND DNS server, which can lead to uncontrolled resource consumption. This can be exploited by a remote attacker to cause a denial of service through the named parameter. The problem occurs when a resolver cache has a large number of ECS records stored for the same name, significantly impairing query performance during cache database node cleaning.

Recommendations For BIND versions 9.11.3-S1 through 9.11.37-S1, update to a version outside of this range to resolve the issue. For BIND versions 9.16.8-S1 through 9.16.45-S1, update to a version outside of this range to resolve the issue. For BIND versions 9.18.11-S1 through 9.18.21-S1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of the ECS component until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-04268

CVE-2023-5680

Affected Products

Bind

References · 13

• https://security-tracker.debian.org/tracker/CVE-2023-5680 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04268 · Security Note
• https://kb.isc.org/docs/cve-2023-5680 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5680 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2023-5680 · Vendor Advisory
• https://twitter.com/OrangeMorishita/status/1757416784339361898 · Twitter Post
• https://vuldb.com/?id.253567 · Note
• https://security.alpinelinux.org/vuln/CVE-2023-5680 · Note
• https://twitter.com/Esparta6108713/status/1764557728951976424 · Twitter Post
• https://twitter.com/CVEnew/status/1757407795261952409 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757428417610256426 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240503-0005 · Note