Critical Memory Consumption Vulnerability in Bind9 Package
Summary
USN-6183-2: bind9 vulnerability. Affects bind9 versions < 1:9.9.5.dfsg-3ubuntu0.19+esm10. Fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bind9 is a widely used DNS server software that provides name resolution services for various applications and systems. It is known for its robustness and flexibility, supporting a range of DNS features. However, recent vulnerabilities have been discovered that could potentially lead to denial of service, affecting the reliability of services that depend on Bind9.
Vulnerability Detail
The vulnerability, identified as CVE-2023-2828, arises from Bind's improper handling of the cache size limit. This flaw allows a remote attacker to exploit the cache mechanism, potentially consuming excessive memory and leading to a denial of service. The issue is particularly critical as it can disrupt DNS services, impacting all applications relying on Bind9 for name resolution. Additionally, another vulnerability (CVE-2023-2911) was found affecting the recursive-clients quota, which could cause Bind to crash, but this only affects Ubuntu 22.04 LTS and later versions.
How To Fix
Minimum fixed version
1:9.9.5.dfsg-3ubuntu0.19+esm10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can limit the number of recursive clients or increase the cache size limit to mitigate the impact of the vulnerability until a patch is applied. However, this is not a permanent solution and should be followed by an update.
Conclusion
The vulnerabilities in Bind9, specifically CVE-2023-2828 and CVE-2023-2911, pose significant risks to DNS services. It is crucial for users to update their Bind9 installations to the latest patched versions to ensure continued service reliability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bind9 →
FAQ
CVE-2023-2828 can lead to memory exhaustion, causing Bind9 to become unresponsive and resulting in denial of service for applications relying on DNS resolution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patched version of Bind9 is available. Users should update to the latest version to mitigate the vulnerability.
If immediate updates are not possible, consider implementing temporary workarounds such as limiting recursive clients or adjusting cache settings.
For more details on vulnerabilities affecting Bind9, you can refer to the official Ubuntu security notices or the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
