Summary

UPDATED: (Corrected the affected fileset levels to reflect that bind.rte 7.1.916.2604 and 7.3.916.2601 are vulnerable) Multiple vulnerabilities in ISC BIND could allow a remote attacker to cause a denial of service. AIX uses ISC BIND as part of its DNS functions.

Vulnerability Details

CVEID:CVE-2023-50868
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an error when preparing an NSEC3 closest encloser proof. By flooding the target resolver with queries, a remote attacker could exploit this vulnerability to cause CPU exhaustion on a DNSSEC-validating resolver.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282901 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-50387
**DESCRIPTION:**Microsoft Windows is vulnerable to a denial of service, caused by improper restriction of DNSSEC verification complexity. By conducting an attack leveraging a highly complex DNSSEC verification framework, a remote attacker could exploit this vulnerability to exhaust CPU resources and stall DNS resolvers, resulting in a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/281081 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-4408
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an error when parsing large DNS messages. By flooding the target server with queries, a remote attacker could exploit this vulnerability to cause excessive CPU load.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282906 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-6516
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an out-of-memory condition. By using specific recursive query patterns, a remote attacker could exploit this vulnerability to cause the amount of memory used by a named resolver to go well beyond the configured max-cache-size limit, leading to a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282902 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-5679
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an error when enabling both DNS64 and serve-stale. By querying a DNS64-enabled resolver for domain names triggering serve-stale, a remote attacker could exploit this vulnerability to trigger an assertion failure.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282904 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-5517
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by a flaw in query-handling code. By querying RFC 1918 reverse zones, a remote attacker could exploit this vulnerability to trigger an assertion failure.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282905 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

The following fileset levels are vulnerable:

To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user’s guide.

Example: lslpp -L | grep -i bind.rte

Remediation/Fixes

A. FIXES

IBM strongly recommends addressing the vulnerability now.

The AIX and VIOS fixes can be downloaded via https from:

<https://aix.software.ibm.com/aix/efixes/security/bind_fix26.tar&gt;

The link above is to a tar file containing this signed advisory, install packages, and OpenSSL signatures for each package. The fixes below include prerequisite checking. This will enforce the correct mapping between the fixes and AIX Technology Levels.

To extract the fixes from the tar file:

tar xvf bind_fix26.tar

For AIX 7.2 and VIOS 3.1 with OpenSSL 1.0 installed:

tar xvf bind_fix26/71bind916.tar

For AIX 7.2 and VIOS 3.1 with OpenSSL 1.1 installed:

tar xvf bind_fix26/72bind916.tar

For AIX 7.3 and VIOS 4.1:

tar xvf bind_fix26/73bind916.tar

IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

To preview the fix installation:

installp -apYd . bind

To install the fix package:

installp -aXYd . bind

Verify you have retrieved the fixes intact:

The checksums below were generated using the “openssl dgst -sha256 [file]” command as the following:

These sums should match exactly. The OpenSSL signatures in the tar file and on this advisory can also be used to verify the integrity of the fixes. If the sums or signatures cannot be confirmed, contact IBM Support at <http://ibm.com/support/&gt; and describe the discrepancy.

openssl dgst -sha256 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]

openssl dgst -sha256 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]

Published advisory OpenSSL signature file location:

<https://aix.software.ibm.com/aix/efixes/security/bind_advisory26.asc.sig&gt;

B. FIX AND INTERIM FIX INSTALLATION

If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

To preview a fix installation:

installp -a -d fix_name -p all # where fix_name is the name of the

fix package being previewed.

To install a fix package:

installp -a -d fix_name -X all # where fix_name is the name of the

fix package being installed.

Interim fixes have had limited functional and regression testing but not the full regression testing that takes place for Service Packs; however, IBM does fully support them.

Interim fix management documentation can be found at:

<https://www.ibm.com/support/pages/managing-interim-fixes-aix&gt;

To preview an interim fix installation:

emgr -e ipkg_name -p # where ipkg_name is the name of the

interim fix package being previewed.

To install an interim fix package:

emgr -e ipkg_name -X # where ipkg_name is the name of the

interim fix package being installed.

Workarounds and Mitigations

None