ISC BIND DoS Vulnerability (CVE-2023-4408) - Windows

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:isc:bind";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.151726");
  script_version("2024-02-15T14:37:33+0000");
  script_tag(name:"last_modification", value:"2024-02-15 14:37:33 +0000 (Thu, 15 Feb 2024)");
  script_tag(name:"creation_date", value:"2024-02-14 04:47:49 +0000 (Wed, 14 Feb 2024)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2024-02-13 14:15:45 +0000 (Tue, 13 Feb 2024)");

  script_cve_id("CVE-2023-4408");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("ISC BIND DoS Vulnerability (CVE-2023-4408) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Denial of Service");
  script_dependencies("gb_isc_bind_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("isc/bind/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"ISC BIND is prone to a denial of service (DoS) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The DNS message parsing code in named includes a section whose
  computational complexity is overly high. It does not cause problems for typical DNS traffic, but
  crafted queries and responses may cause excessive CPU load on the affected named instance by
  exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.");

  script_tag(name:"impact", value:"By flooding the target server with queries exploiting this flaw
  an attacker can significantly impair the server's performance, effectively denying legitimate
  clients access to the DNS resolution service.");

  script_tag(name:"affected", value:"ISC BIND version 9.0.0 through 9.16.45, 9.18.0 through
  9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1 and
  9.18.11-S1 through 9.18.21-S1.");

  script_tag(name:"solution", value:"Update to version 9.16.48, 9.18.24, 9.19.21, 9.16.48-S1,
  9.18.24-S1 or later.");

  script_xref(name:"URL", value:"https://kb.isc.org/docs/cve-2023-4408");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_full(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
proto = infos["proto"];
location = infos["location"];

if (version =~ "^9\.[0-9]+\.[0-9]+s[0-9]") {
  if (version_in_range(version: version, test_version: "9.9.3s1", test_version2: "9.11.37s1") ||
      version_in_range(version: version, test_version: "9.16.8s1", test_version2: "9.16.45s1")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.16.48-S1", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }

  if (version_in_range(version: version, test_version: "9.18.11s1", test_version2: "9.18.21s1")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.18.24-S1", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }
} else {
  if (version_in_range(version: version, test_version: "9.0.0", test_version2: "9.16.45")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.16.48", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }

  if (version_in_range(version: version, test_version: "9.18.0", test_version2: "9.18.21")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.18.24", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }

  if (version_in_range(version: version, test_version: "9.19.0", test_version2: "9.19.19")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.19.21", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }
}

exit(99);