SUSE update for bind
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2023-4408 CVE-2023-50387 CVE-2023-50868 CVE-2023-5517 CVE-2023-6516 |
| CWE-ID | CWE-400 CWE-617 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. |
| Vulnerable software |
SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Manager Client Tools for SLE Micro Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP2 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system libbind9-1600-64bit Operating systems & Components / Operating system package or component libdns1605-64bit Operating systems & Components / Operating system package or component libisccfg1600-64bit Operating systems & Components / Operating system package or component libisc1606-64bit Operating systems & Components / Operating system package or component libirs1601-64bit Operating systems & Components / Operating system package or component libisccc1600-64bit Operating systems & Components / Operating system package or component bind-doc Operating systems & Components / Operating system package or component python3-bind Operating systems & Components / Operating system package or component libisc1606-debuginfo Operating systems & Components / Operating system package or component libisccc1600-debuginfo Operating systems & Components / Operating system package or component libirs-devel Operating systems & Components / Operating system package or component libns1604 Operating systems & Components / Operating system package or component libbind9-1600-debuginfo Operating systems & Components / Operating system package or component bind-utils-debuginfo Operating systems & Components / Operating system package or component bind-devel Operating systems & Components / Operating system package or component bind-chrootenv Operating systems & Components / Operating system package or component libuv1 Operating systems & Components / Operating system package or component bind-debugsource Operating systems & Components / Operating system package or component libdns1605 Operating systems & Components / Operating system package or component libuv1-debuginfo Operating systems & Components / Operating system package or component libuv-debugsource Operating systems & Components / Operating system package or component libirs1601-debuginfo Operating systems & Components / Operating system package or component libns1604-debuginfo Operating systems & Components / Operating system package or component libisccc1600 Operating systems & Components / Operating system package or component libuv-devel Operating systems & Components / Operating system package or component bind-debuginfo Operating systems & Components / Operating system package or component libisccfg1600-debuginfo Operating systems & Components / Operating system package or component bind Operating systems & Components / Operating system package or component libisccfg1600 Operating systems & Components / Operating system package or component libisc1606 Operating systems & Components / Operating system package or component bind-utils Operating systems & Components / Operating system package or component libdns1605-debuginfo Operating systems & Components / Operating system package or component libirs1601 Operating systems & Components / Operating system package or component libbind9-1600 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Resource exhaustion
EUVDB-ID: #VU86383
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-4408
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing DNS messages. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationUpdate the affected package bind to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Linux Enterprise Server for SAP Applications 15: SP2
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Server 15: SP2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise High Performance Computing 15: SP2
libbind9-1600-64bit: before 9.16.6-150000.12.74.2
libdns1605-64bit: before 9.16.6-150000.12.74.2
libisccfg1600-64bit: before 9.16.6-150000.12.74.2
libisc1606-64bit: before 9.16.6-150000.12.74.2
libirs1601-64bit: before 9.16.6-150000.12.74.2
libisccc1600-64bit: before 9.16.6-150000.12.74.2
bind-doc: before 9.16.6-150000.12.74.2
python3-bind: before 9.16.6-150000.12.74.2
libisc1606-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600-debuginfo: before 9.16.6-150000.12.74.2
libirs-devel: before 9.16.6-150000.12.74.2
libns1604: before 9.16.6-150000.12.74.2
libbind9-1600-debuginfo: before 9.16.6-150000.12.74.2
bind-utils-debuginfo: before 9.16.6-150000.12.74.2
bind-devel: before 9.16.6-150000.12.74.2
bind-chrootenv: before 9.16.6-150000.12.74.2
libuv1: before 1.18.0-150000.3.2.1
bind-debugsource: before 9.16.6-150000.12.74.2
libdns1605: before 9.16.6-150000.12.74.2
libuv1-debuginfo: before 1.18.0-150000.3.2.1
libuv-debugsource: before 1.18.0-150000.3.2.1
libirs1601-debuginfo: before 9.16.6-150000.12.74.2
libns1604-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600: before 9.16.6-150000.12.74.2
libuv-devel: before 1.18.0-150000.3.2.1
bind-debuginfo: before 9.16.6-150000.12.74.2
libisccfg1600-debuginfo: before 9.16.6-150000.12.74.2
bind: before 9.16.6-150000.12.74.2
libisccfg1600: before 9.16.6-150000.12.74.2
libisc1606: before 9.16.6-150000.12.74.2
bind-utils: before 9.16.6-150000.12.74.2
libdns1605-debuginfo: before 9.16.6-150000.12.74.2
libirs1601: before 9.16.6-150000.12.74.2
libbind9-1600: before 9.16.6-150000.12.74.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libbind9-1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:python3-bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-chrootenv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20242033-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Resource exhaustion
EUVDB-ID: #VU86377
Risk: Medium
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2023-50387
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.
MitigationUpdate the affected package bind to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Linux Enterprise Server for SAP Applications 15: SP2
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Server 15: SP2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise High Performance Computing 15: SP2
libbind9-1600-64bit: before 9.16.6-150000.12.74.2
libdns1605-64bit: before 9.16.6-150000.12.74.2
libisccfg1600-64bit: before 9.16.6-150000.12.74.2
libisc1606-64bit: before 9.16.6-150000.12.74.2
libirs1601-64bit: before 9.16.6-150000.12.74.2
libisccc1600-64bit: before 9.16.6-150000.12.74.2
bind-doc: before 9.16.6-150000.12.74.2
python3-bind: before 9.16.6-150000.12.74.2
libisc1606-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600-debuginfo: before 9.16.6-150000.12.74.2
libirs-devel: before 9.16.6-150000.12.74.2
libns1604: before 9.16.6-150000.12.74.2
libbind9-1600-debuginfo: before 9.16.6-150000.12.74.2
bind-utils-debuginfo: before 9.16.6-150000.12.74.2
bind-devel: before 9.16.6-150000.12.74.2
bind-chrootenv: before 9.16.6-150000.12.74.2
libuv1: before 1.18.0-150000.3.2.1
bind-debugsource: before 9.16.6-150000.12.74.2
libdns1605: before 9.16.6-150000.12.74.2
libuv1-debuginfo: before 1.18.0-150000.3.2.1
libuv-debugsource: before 1.18.0-150000.3.2.1
libirs1601-debuginfo: before 9.16.6-150000.12.74.2
libns1604-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600: before 9.16.6-150000.12.74.2
libuv-devel: before 1.18.0-150000.3.2.1
bind-debuginfo: before 9.16.6-150000.12.74.2
libisccfg1600-debuginfo: before 9.16.6-150000.12.74.2
bind: before 9.16.6-150000.12.74.2
libisccfg1600: before 9.16.6-150000.12.74.2
libisc1606: before 9.16.6-150000.12.74.2
bind-utils: before 9.16.6-150000.12.74.2
libdns1605-debuginfo: before 9.16.6-150000.12.74.2
libirs1601: before 9.16.6-150000.12.74.2
libbind9-1600: before 9.16.6-150000.12.74.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libbind9-1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:python3-bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-chrootenv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20242033-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
3) Resource exhaustion
EUVDB-ID: #VU86378
Risk: Medium
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2023-50868
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.
MitigationUpdate the affected package bind to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Linux Enterprise Server for SAP Applications 15: SP2
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Server 15: SP2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise High Performance Computing 15: SP2
libbind9-1600-64bit: before 9.16.6-150000.12.74.2
libdns1605-64bit: before 9.16.6-150000.12.74.2
libisccfg1600-64bit: before 9.16.6-150000.12.74.2
libisc1606-64bit: before 9.16.6-150000.12.74.2
libirs1601-64bit: before 9.16.6-150000.12.74.2
libisccc1600-64bit: before 9.16.6-150000.12.74.2
bind-doc: before 9.16.6-150000.12.74.2
python3-bind: before 9.16.6-150000.12.74.2
libisc1606-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600-debuginfo: before 9.16.6-150000.12.74.2
libirs-devel: before 9.16.6-150000.12.74.2
libns1604: before 9.16.6-150000.12.74.2
libbind9-1600-debuginfo: before 9.16.6-150000.12.74.2
bind-utils-debuginfo: before 9.16.6-150000.12.74.2
bind-devel: before 9.16.6-150000.12.74.2
bind-chrootenv: before 9.16.6-150000.12.74.2
libuv1: before 1.18.0-150000.3.2.1
bind-debugsource: before 9.16.6-150000.12.74.2
libdns1605: before 9.16.6-150000.12.74.2
libuv1-debuginfo: before 1.18.0-150000.3.2.1
libuv-debugsource: before 1.18.0-150000.3.2.1
libirs1601-debuginfo: before 9.16.6-150000.12.74.2
libns1604-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600: before 9.16.6-150000.12.74.2
libuv-devel: before 1.18.0-150000.3.2.1
bind-debuginfo: before 9.16.6-150000.12.74.2
libisccfg1600-debuginfo: before 9.16.6-150000.12.74.2
bind: before 9.16.6-150000.12.74.2
libisccfg1600: before 9.16.6-150000.12.74.2
libisc1606: before 9.16.6-150000.12.74.2
bind-utils: before 9.16.6-150000.12.74.2
libdns1605-debuginfo: before 9.16.6-150000.12.74.2
libirs1601: before 9.16.6-150000.12.74.2
libbind9-1600: before 9.16.6-150000.12.74.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libbind9-1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:python3-bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-chrootenv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20242033-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
4) Reachable Assertion
EUVDB-ID: #VU86382
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-5517
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion when querying RFC 1918 reverse zones. A remote attacker can send a specially crafted DNS query and perform a denial of service attack.
Update the affected package bind to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Linux Enterprise Server for SAP Applications 15: SP2
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Server 15: SP2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise High Performance Computing 15: SP2
libbind9-1600-64bit: before 9.16.6-150000.12.74.2
libdns1605-64bit: before 9.16.6-150000.12.74.2
libisccfg1600-64bit: before 9.16.6-150000.12.74.2
libisc1606-64bit: before 9.16.6-150000.12.74.2
libirs1601-64bit: before 9.16.6-150000.12.74.2
libisccc1600-64bit: before 9.16.6-150000.12.74.2
bind-doc: before 9.16.6-150000.12.74.2
python3-bind: before 9.16.6-150000.12.74.2
libisc1606-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600-debuginfo: before 9.16.6-150000.12.74.2
libirs-devel: before 9.16.6-150000.12.74.2
libns1604: before 9.16.6-150000.12.74.2
libbind9-1600-debuginfo: before 9.16.6-150000.12.74.2
bind-utils-debuginfo: before 9.16.6-150000.12.74.2
bind-devel: before 9.16.6-150000.12.74.2
bind-chrootenv: before 9.16.6-150000.12.74.2
libuv1: before 1.18.0-150000.3.2.1
bind-debugsource: before 9.16.6-150000.12.74.2
libdns1605: before 9.16.6-150000.12.74.2
libuv1-debuginfo: before 1.18.0-150000.3.2.1
libuv-debugsource: before 1.18.0-150000.3.2.1
libirs1601-debuginfo: before 9.16.6-150000.12.74.2
libns1604-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600: before 9.16.6-150000.12.74.2
libuv-devel: before 1.18.0-150000.3.2.1
bind-debuginfo: before 9.16.6-150000.12.74.2
libisccfg1600-debuginfo: before 9.16.6-150000.12.74.2
bind: before 9.16.6-150000.12.74.2
libisccfg1600: before 9.16.6-150000.12.74.2
libisc1606: before 9.16.6-150000.12.74.2
bind-utils: before 9.16.6-150000.12.74.2
libdns1605-debuginfo: before 9.16.6-150000.12.74.2
libirs1601: before 9.16.6-150000.12.74.2
libbind9-1600: before 9.16.6-150000.12.74.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libbind9-1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:python3-bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-chrootenv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20242033-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Resource exhaustion
EUVDB-ID: #VU86379
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-6516
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing specific recursive patterns. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack against the DNS resolver.
MitigationUpdate the affected package bind to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Linux Enterprise Server for SAP Applications 15: SP2
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Server 15: SP2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise High Performance Computing 15: SP2
libbind9-1600-64bit: before 9.16.6-150000.12.74.2
libdns1605-64bit: before 9.16.6-150000.12.74.2
libisccfg1600-64bit: before 9.16.6-150000.12.74.2
libisc1606-64bit: before 9.16.6-150000.12.74.2
libirs1601-64bit: before 9.16.6-150000.12.74.2
libisccc1600-64bit: before 9.16.6-150000.12.74.2
bind-doc: before 9.16.6-150000.12.74.2
python3-bind: before 9.16.6-150000.12.74.2
libisc1606-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600-debuginfo: before 9.16.6-150000.12.74.2
libirs-devel: before 9.16.6-150000.12.74.2
libns1604: before 9.16.6-150000.12.74.2
libbind9-1600-debuginfo: before 9.16.6-150000.12.74.2
bind-utils-debuginfo: before 9.16.6-150000.12.74.2
bind-devel: before 9.16.6-150000.12.74.2
bind-chrootenv: before 9.16.6-150000.12.74.2
libuv1: before 1.18.0-150000.3.2.1
bind-debugsource: before 9.16.6-150000.12.74.2
libdns1605: before 9.16.6-150000.12.74.2
libuv1-debuginfo: before 1.18.0-150000.3.2.1
libuv-debugsource: before 1.18.0-150000.3.2.1
libirs1601-debuginfo: before 9.16.6-150000.12.74.2
libns1604-debuginfo: before 9.16.6-150000.12.74.2
libisccc1600: before 9.16.6-150000.12.74.2
libuv-devel: before 1.18.0-150000.3.2.1
bind-debuginfo: before 9.16.6-150000.12.74.2
libisccfg1600-debuginfo: before 9.16.6-150000.12.74.2
bind: before 9.16.6-150000.12.74.2
libisccfg1600: before 9.16.6-150000.12.74.2
libisc1606: before 9.16.6-150000.12.74.2
bind-utils: before 9.16.6-150000.12.74.2
libdns1605-debuginfo: before 9.16.6-150000.12.74.2
libirs1601: before 9.16.6-150000.12.74.2
libbind9-1600: before 9.16.6-150000.12.74.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libbind9-1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:python3-bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-chrootenv:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libns1604-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccc1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libuv-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisccfg1600:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libisc1606:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:bind-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libdns1605-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libirs1601:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libbind9-1600:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20242033-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
