Critical Denial of Service Vulnerabilities in Bind9 Package
Summary
USN-6723-1: bind9 vulnerabilities. Affects bind9 versions < 1:9.9.5.dfsg-3ubuntu0.19+esm12. Fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bind9 is a widely used DNS server software that provides a robust and flexible DNS service for various applications. It is known for its reliability and extensive features, including DNSSEC support for secure DNS transactions. However, recent vulnerabilities have been discovered that could compromise its stability and security, making it essential for users to stay updated with the latest patches.
Vulnerability Detail
The vulnerabilities identified in Bind9 stem from improper handling of DNSSEC messages and NSEC3 closest encloser proofs. These flaws allow remote attackers to exploit the server, potentially leading to resource exhaustion and denial of service. Specifically, CVE-2023-50387 and CVE-2023-50868 highlight the risks associated with these vulnerabilities, which can disrupt DNS services and affect network operations.
How To Fix
Minimum fixed version
1:9.9.5.dfsg-3ubuntu0.19+esm12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their Bind9 servers by implementing firewall rules to restrict access to trusted IP addresses only. This can help reduce the risk of exploitation until the package is updated.
Conclusion
In summary, the recent vulnerabilities in the Bind9 package pose significant risks to DNS services, making it imperative for users to update to the latest patched versions. By following the recommended steps and utilizing tools like Vulert, users can effectively manage and mitigate these vulnerabilities.
See every vulnerability recorded for bind9 →
FAQ
The vulnerabilities include improper handling of DNSSEC messages and NSEC3 closest encloser proofs, which can lead to denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Exploitation of these vulnerabilities can lead to resource exhaustion, causing the Bind9 server to become unresponsive and disrupt DNS services.
Yes, patches are available. Users should update to the latest version of Bind9 to mitigate the risks.
Implement firewall rules to restrict access to your Bind9 server as a temporary workaround until you can apply the updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
