Resource Exhaustion Vulnerability in BIND Package
Summary
CVE-2024-11187: It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. Affects bind versions < 9.18.33-r0. Fixed in 9.18.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is one of the most widely used DNS (Domain Name System) server software packages. It provides a robust and flexible platform for managing DNS services, enabling the resolution of domain names to IP addresses. BIND is known for its high performance, reliability, and extensive features, making it a critical component in many network infrastructures. However, certain versions of BIND are vulnerable to a resource exhaustion attack, which can lead to denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2024-11187, allows an attacker to construct a DNS zone that generates responses with numerous records in the Additional section. By sending a high volume of such queries, an attacker can cause either the authoritative server or an independent resolver to consume disproportionate resources, potentially leading to service degradation or denial of service. This vulnerability primarily affects specific versions of BIND 9, which must be deliberately crafted to exploit this issue.
How To Fix
Minimum fixed version
9.18.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on DNS queries to mitigate the impact of potential resource exhaustion attacks. This can help control the number of queries processed by the server and reduce the risk of service disruption.
Conclusion
CVE-2024-11187 represents a significant resource exhaustion vulnerability in various versions of the BIND package. It is crucial for users to update their installations to the patched versions to protect against potential denial of service attacks. Additionally, implementing rate limiting can serve as a temporary measure to mitigate risks until updates are applied.
See every vulnerability recorded for bind →
FAQ
CVE-2024-11187 is a vulnerability in BIND that allows attackers to exploit resource exhaustion by sending specially crafted DNS queries.
Affected versions include BIND 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, and several others.
The vulnerability can lead to denial of service by exhausting server resources, causing service degradation or outages.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
Yes, implementing rate limiting on DNS queries can help mitigate the risk of resource exhaustion attacks.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
