Critical Crash Vulnerability in BIND 9 Package: CVE-2022-3736
Summary
UBUNTU-CVE-2022-3736: BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to a positive integer, and the resolver receives an RRSIG query. Affects bind9 versions < 1:9.18.1-1ubuntu1.3. Fixed in 1:9.18.1-1ubuntu1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND 9 is a widely used DNS server software that provides a robust and flexible solution for domain name resolution. It is essential for the functioning of the internet, allowing users to access websites using human-readable domain names. The package includes various components such as bind9, bind9-dev, and bind9-utils, which facilitate DNS queries and management. However, a critical vulnerability has been identified that can lead to a crash under specific conditions, affecting the reliability of DNS services.
Vulnerability Detail
The vulnerability, identified as CVE-2022-3736, occurs when the BIND 9 resolver is configured with stale cache and stale answers enabled, and the option 'stale-answer-client-timeout' is set to a positive integer. When the resolver receives an RRSIG query under these conditions, it can crash, leading to potential service disruptions. This issue affects multiple versions of BIND 9, specifically versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and their respective S1 versions. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1:9.18.1-1ubuntu1.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the stale cache and stale answers feature by setting the 'stale-answer-client-timeout' option to zero in your BIND configuration file. This can be done by adding the following line to your named.conf.options file: 'stale-answer-client-timeout 0;'. However, this may affect the performance of DNS resolution.
Conclusion
CVE-2022-3736 is a significant vulnerability in the BIND 9 package that can lead to service disruptions if not addressed. Users are strongly advised to update to the patched version or apply the recommended workaround to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for bind9 →
FAQ
CVE-2022-3736 is a critical vulnerability in the BIND 9 DNS server that can cause the resolver to crash under specific configurations.
The vulnerability affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, and 9.19.0 through 9.19.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider applying the workaround by disabling stale cache and stale answers in your BIND configuration.
The CVSS score for CVE-2022-3736 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
