CVE-2024-4076

CVE-2024-4076: ISC BIND can trigger an assertion failure when serving both stale cache data and authoritative zone content. Affects multiple BIND 9 releases (e.g., 9.16.13–9.16.50, 9.18.0–9.18.27, 9.19.0–9.19.24 and corresponding S1 variants; see references). Consequence is denial of service via ...

CVE-2024-4076

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

CVE-2024-4076 Assertion failure when serving both stale cache data and authoritative zone content

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

CVE-2024-4076 Assertion failure when serving both stale cache data and authoritative zone content

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

CVE-2024-4076

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

CVE-2024-1975

If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG0 signed requests. This issue affects BIND 9 versions 9.0.0 through...

CVE-2024-1975

If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG0 signed requests. This issue affects BIND 9 versions 9.0.0 through...

CVE-2024-1975

CVE-2024-1975 describes a denial-of-service in ISC BIND where a client can exhaust resolver CPU by sending a flood of SIG(0) signed requests if a zone contains a KEY RR or DNSSEC validation occurs from cache. Affected are BIND 9.x builds listed in the CVE description (notably older 9.x releases u...

CVE-2024-1975 SIG(0) can be used to exhaust CPU resources

If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG0 signed requests. This issue affects BIND 9 versions 9.0.0 through...

CVE-2024-1975 SIG(0) can be used to exhaust CPU resources

If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG0 signed requests. This issue affects BIND 9 versions 9.0.0 through...

CVE-2024-0760

CVE-2024-0760 affects ISC BIND 9, specifically versions 9.18.1–9.18.27, 9.19.0–9.19.24, and 9.18.11-S1–9.18.27-S1. Description: a malicious client can flood the server with DNS messages over TCP, potentially destabilizing the server; recovery is possible after the attack stops. Impact is availabi...

CVE-2024-0760 A flood of DNS messages over TCP may make the server unstable

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0...

CVE-2024-0760

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0...

CVE-2024-0760 A flood of DNS messages over TCP may make the server unstable

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0...

CVE-2024-0760

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0...

CVE-2024-28872

The CVE-2024-28872 issue affects ISC Stork versions 0.15.0 through 1.15.0 and stems from flawed TLS certificate validation. An attacker could obtain a TLS certificate from the Stork server and use it to connect to the Stork agent, then issue malicious commands to monitored services (Kea or BIND 9...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

Oracle Linux 8 : bind / and / dhcp (ELSA-2024-1782)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1782 advisory. - Speed up parsing of DNS messages with many different names CVE-2023-4408 - Prevent increased CPU consumption in DNSSEC validator CVE-2023-50387...

K000138991: BIND vulnerability CVE-2023-6516

Security Advisory Description To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is...