ISC BIND DoS Vulnerability (CVE-2024-11187) - Linux

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:isc:bind";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.153891");
  script_version("2025-01-31T05:37:27+0000");
  script_tag(name:"last_modification", value:"2025-01-31 05:37:27 +0000 (Fri, 31 Jan 2025)");
  script_tag(name:"creation_date", value:"2025-01-30 01:52:59 +0000 (Thu, 30 Jan 2025)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-01-29 22:15:28 +0000 (Wed, 29 Jan 2025)");

  script_cve_id("CVE-2024-11187");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("ISC BIND DoS Vulnerability (CVE-2024-11187) - Linux");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Denial of Service");
  script_dependencies("gb_isc_bind_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("isc/bind/detected", "Host/runs_unixoide");

  script_tag(name:"summary", value:"ISC BIND is prone to a denial of service (DoS)
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"It is possible to construct a zone such that some queries to it
  will generate responses containing numerous records in the Additional section. An attacker
  sending many such queries can cause either the authoritative server itself or an independent
  resolver to use disproportionate resources processing the queries. Zones will usually need to
  have been deliberately crafted to attack this exposure.");

  script_tag(name:"impact", value:"A named instance vulnerable to this issue can be compelled to
  consume excessive CPU resources up to the point where exhaustion of resources effectively
  prevents the server from responding to other client queries. This issue is most likely to affect
  resolvers but could also degrade authoritative server performance.

  - Authoritative servers are affected by this vulnerability.

  - Resolvers are affected by this vulnerability.");

  script_tag(name:"affected", value:"ISC BIND version 9.11.37 and prior, 9.16.0 through 9.16.50,
  9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through
  9.11.37-S1, 9.16.8-S1 through 9.16.50-S1 and 9.18.11-S1 through 9.18.32-S1.");

  script_tag(name:"solution", value:"Update to version 9.18.33, 9.20.5, 9.21.4, 9.18.33-S1 or
  later.");

  script_xref(name:"URL", value:"https://kb.isc.org/docs/cve-2024-11187");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_full(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
proto = infos["proto"];
location = infos["location"];

if (version =~ "^9\.[0-9]+\.[0-9]+s[0-9]") {
  if (version_in_range(version: version, test_version: "9.11.3s1", test_version2: "9.11.37s1") ||
      version_in_range(version: version, test_version: "9.16.8s1", test_version2: "9.16.50s1") ||
      version_in_range(version: version, test_version: "9.18.11s1", test_version2: "9.18.32s1")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.18.33-S1", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }
} else {
  if (version_in_range(version: version, test_version: "9.11.0", test_version2: "9.11.37") ||
      version_in_range(version: version, test_version: "9.16.0", test_version2: "9.16.50") ||
      version_in_range(version: version, test_version: "9.18.0", test_version2: "9.18.32")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.18.33", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }

  if (version_in_range(version: version, test_version: "9.20.0", test_version2: "9.20.4")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.20.5", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }

  if (version_in_range(version: version, test_version: "9.21.0", test_version2: "9.21.3")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.21.4", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }
}

exit(99);