CVE-2022-3080: Denial of Service Vulnerability in bind
Summary
CVE-2022-3080: By sending specific queries to the resolver, an attacker can cause named to crash. Affects bind across 3 version ranges.
>= 8db45afa1affcb823e68afdeddedf93e136f5d3e, < 85a6eb108e884467c4b3af414140d6b033a89a62
< 9.16.33-r0
< 35e9c6e31dd742f501624a31c3326db1c7b460fe
Fixed in 9.16.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bind is an open-source DNS server software that provides domain name resolution services. It is widely used in various operating systems and distributions, including Alpine Linux. The vulnerability, CVE-2022-3080, allows an attacker to crash the named resolver by sending specific queries.
Vulnerability Detail
The vulnerability arises from a flaw in the bind software that can be exploited by sending specially crafted queries to the resolver. When the vulnerable bind version receives these queries, it crashes, resulting in a denial of service condition. This vulnerability can be exploited remotely without authentication. The impact of this vulnerability is limited to the availability of the DNS resolution service.
How To Fix
Minimum fixed version
9.16.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the available fix by updating bind to the fixed versions.
Conclusion
CVE-2022-3080 is a denial of service vulnerability in bind that allows an attacker to crash the named resolver by sending specific queries. It can be fixed by updating bind to the recommended versions. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
bind is an open-source DNS server software that provides domain name resolution services.
The vulnerability allows an attacker to crash the named resolver, resulting in a denial of service condition for the DNS resolution service.
Yes, this vulnerability can be exploited remotely without authentication.
No, there is no known workaround. It is recommended to update bind to the fixed versions.
To fix this vulnerability, update bind to version 9.16.33-r0 for Alpine Linux versions 3.13 to 3.16, and version 9.18.7-r0 for Alpine Linux versions 3.17 and 3.18.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
