Critical Vulnerability in Bind9 Package: Denial of Service Risk
Summary
UBUNTU-CVE-2022-3080: By sending specific queries to the resolver, an attacker can cause named to crash. Affects bind9 versions < 1:9.18.1-1ubuntu1.2. Fixed in 1:9.18.1-1ubuntu1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bind9 is a widely used DNS server software that provides name resolution services for various applications and systems. It is known for its robustness and flexibility, supporting a range of DNS features. However, it is susceptible to specific vulnerabilities that can be exploited by attackers, leading to potential service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2022-3080 allows an attacker to send specially crafted queries to the Bind9 resolver, which can cause the named service to crash. This denial of service (DoS) vulnerability can disrupt DNS services, affecting all applications relying on Bind9 for name resolution. The issue arises from improper handling of certain query types, leading to instability in the service. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1:9.18.1-1ubuntu1.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the Bind9 service by configuring firewall rules to restrict incoming queries from untrusted sources. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2022-3080 vulnerability in the Bind9 package poses a significant risk of denial of service. It is crucial for users to update to the latest patched version to mitigate this risk. Additionally, temporary workarounds can help protect systems until the update is applied.
See every vulnerability recorded for bind9 →
FAQ
CVE-2022-3080 is a vulnerability in the Bind9 DNS server that allows attackers to crash the service by sending specific queries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, causing disruptions in DNS resolution for applications relying on Bind9.
Yes, a patched version of Bind9 is available. Users should update to version 1:9.18.1-1ubuntu1.2 or later.
If immediate updates are not possible, consider implementing firewall rules to restrict access to the Bind9 service as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
