CVE-2023-5679

A flaw was found in the bind package. This issue may allow an attacker to query in a DNS64 enabled resolver node with a domain name triggering a server-stale data, triggering a code assertion, and resulting in a crash of named processes. This can allow a remote unauthenticated user to cause a Denial Of Service in the DNS server.

Mitigation

This vulnerability can be mitigated by either disabled server-stale configuration, using both of the switches bellow in named configuration file:

1. set stale-cache-enable no;
2. set stale-answer-enable no;

Alternatively, disable the DNS64 option. Both mitigations should make the affected code unreachable, making it impossible to an attacker to exploit this vulnerability.