BIND 9 Vulnerability: Assertion Failure in Named Daemon
Summary
CVE-2022-1183: On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Affects bind9 across 3 version ranges.
< 1:9.18.3-1
>= 8db45afa1affcb823e68afdeddedf93e136f5d3e, <= 3babb1557aef04ec3834d00b17013ae9fa5a434b
< cab15392afd841fe3b0bacd894003376d857459a
Fixed in 1:9.18.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides name resolution services for the internet. It is known for its flexibility, scalability, and support for various DNS protocols, including DNS over TLS (DoT) and DNS over HTTPS (DoH). However, certain configurations of BIND can lead to vulnerabilities, such as the one identified in CVE-2022-1183, which affects versions 9.18.0 to 9.18.2 and 9.19.0 of the development branch. This vulnerability can cause the named daemon to terminate unexpectedly under specific conditions, particularly when HTTP references are included in the listen-on statements of the named.conf configuration file.
Vulnerability Detail
CVE-2022-1183 is a vulnerability that arises from improper handling of configurations that reference HTTP within the listen-on statements in the named.conf file. When such configurations are present, the named daemon may encounter an assertion failure, leading to a crash. This can disrupt DNS services and impact applications relying on DNS resolution. Importantly, configurations using DNS over TLS (DoT) alone are not affected, making it crucial for administrators to review their configurations to mitigate this risk.
How To Fix
Minimum fixed version
1:9.18.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can remove any references to HTTP in the listen-on statements of the named.conf file. This can be done by editing the configuration file:
- Open the named.conf file:
sudo nano /etc/bind/named.conf
- Locate any lines that include 'http' in the listen-on statements and remove or comment them out.
- Save the changes and restart the BIND service:
sudo systemctl restart bind9
Conclusion
CVE-2022-1183 is a significant vulnerability affecting certain configurations of BIND, leading to potential service disruptions. Administrators are advised to update their BIND installations to the latest version and review their configurations to ensure they are not using HTTP references in listen-on statements. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for bind9 →
FAQ
CVE-2022-1183 is a vulnerability in BIND that can cause the named daemon to terminate unexpectedly due to an assertion failure when certain configurations are used.
The vulnerability affects BIND versions 9.18.0 to 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
You can check your BIND version by running the command 'named -v' in the terminal. If your version falls within the affected range, you should take action to mitigate the vulnerability.
If exploited, this vulnerability can lead to the named daemon crashing, which disrupts DNS services and affects applications relying on DNS resolution.
Yes, Vulert can monitor and alert for open-source vulnerabilities in your software using just a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
