Resource exhaustion in ISC BIND - CVE-2024-11187

Vulnerability identifier: #VU103436

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-11187

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling DNS zones with numerous records in the Additional section. A remote attacker can trigger resource exhaustion by sending multiple queries to he affected server and perform a denial of service (DoS) attack.

ISC BIND
PowerStore 500T
PowerStore 1200T
PowerStore 3000T
PowerStore 3200Q
PowerStore 1000T
PowerStore 3200T
PowerStore 5000T
PowerStore 5200T
PowerStore 7000T
PowerStore 9000T
PowerStore 9200T
BIG-IP
PowerStoreT OS
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
Anolis OS
SUSE Enterprise Storage
IBM i
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Slackware Linux
Basesystem Module
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Oracle Solaris
Netcool Operations Insight
IBM Spectrum Symphony
Submariner
IBM Observability with Instana
APEX Cloud Platform for Red Hat OpenShift
Red Hat Advanced Cluster Security for Kubernetes
Dell Secure Connect Gateway
Session Smart Router
PowerProtect Data Manager
IBM Cloud Pak for Watson AIOps
APEX Cloud Platform for Microsoft Azure
Storage Resource Manager
SmartFabric OS10
IBM Edge Application Manager
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
dhcp-devel
dhcp-debugsource
dhcp-debuginfo
dhcp
dhcp-help
bind (Red Hat package) main
bind-pkcs11-devel
bind-export-devel
bind-export-libs
bind-libs
bind-libs-lite
bind-lite-devel
bind-pkcs11
bind-license
bind-pkcs11-libs
bind-pkcs11-utils
bind-devel
bind-chroot
bind
bind-sdb
bind-sdb-chroot
bind-utils
bind-debuginfo
bind-debugsource
python3-bind
libbind9-161
libisc1107-debuginfo
libisccc161
libisccc161-debuginfo
libisc1107
python-bind
bind-doc
libisc1107-debuginfo-32bit
libisc1107-32bit
libirs161-debuginfo
liblwres161-debuginfo
bind-utils-debuginfo
libirs161
libdns1110
bind-chrootenv
libisccfg163
libbind9-161-debuginfo
libdns1110-debuginfo
liblwres161
libisccfg163-debuginfo
libisccc1600
libisc1606
libns1604-debuginfo
libbind9-1600
libns1604
libirs1601
libisccc1600-64bit
libdns1605
libisccfg1600
libisccfg1600-64bit
libbind9-1600-64bit
libisc1606-64bit
libdns1605-64bit
libirs1601-64bit
libirs1601-debuginfo
libisccc1600-debuginfo
libbind9-1600-debuginfo
libisc1606-debuginfo
libisccfg1600-debuginfo
libdns1605-debuginfo
libirs-devel
bind9.16 (Red Hat package)
bind9.16-license
python3-bind9.16
bind9.16
bind9.16-chroot
bind9.16-devel
bind9.16-dnssec-utils
bind9.16-libs
bind9.16-utils
bind9.16-doc
bind-dnssec-utils
bind-dnssec-doc
bind9.18 (Red Hat package)
bind9 (Ubuntu package)
bind9 (Debian package)
bind-dyndb-ldap
IBM API Connect
SmartFabric Manager
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
Dell EMC Storage Monitoring and Reporting (SMR)
Juniper Secure Analytics (JSA)

Install update from vendor's website.

ISC BIND - addressed in versions 9.18.33, 9.18.33-S1, 9.20.5, 9.21.4
Netcool Operations Insight - update to 1.6.15
IBM Cloud Pak for Watson AIOps - update to 4.10.0
IBM Spectrum Symphony - update to 7.3.2 FP3
IBM Qradar SIEM - update to 7.5.0 Update Pack 11 IF03
IBM API Connect - update to 10.0.8.2 ifix2
Submariner - addressed in versions 0.17.6, 0.18.5
IBM Observability with Instana - update to 1.0.293
SmartFabric Manager - update to 1.3.0
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
Multicluster Engine for Kubernetes - addressed in versions 2.4.9, 2.5.9, 2.6.7, 2.7.4
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4, 4.18.0
PowerStoreT OS - update to 4.0.1.3-2494147
dhcp-devel - update to 4.4.2-14
dhcp-debugsource - update to 4.4.2-14
dhcp-debuginfo - update to 4.4.2-14
dhcp - update to 4.4.2-14
dhcp-help - update to 4.4.2-14
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.5.7, 4.6.0, 4.6.3
Red Hat OpenShift Container Platform - addressed in versions 4.12.74, 4.15.47, 4.16.44, 4.18.6, 4.18.9
OpenShift Virtualization - addressed in versions 4.15.9, 4.16.7
Dell EMC Storage Monitoring and Reporting (SMR) - addressed in versions 5.0.2.2, 5.1.0.0
Storage Resource Manager - addressed in versions 5.0.2.2, 5.1.0.0
Dell Secure Connect Gateway - update to 5.28.00.14
Session Smart Router - addressed in versions 6.2.10, 6.3.7
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
bind (Red Hat package) main - addressed in versions 9.8.2-0.68.rc1.el6_10.15, 9.11.4-9.P2.el7_7.8, 9.11.4-26.P2.el7_9.18, 9.11.13-6.el8_2.10, 9.11.26-4.el8_4.7, 9.11.36-3.el8_6.10, 9.11.36-8.el8_8.7, 9.11.36-16.el8_10.4, 9.16.23-1.el9_0.10, 9.16.23-11.el9_2.8, 9.16.23-18.el9_4.9, 9.16.23-24.el9_5.3
bind-pkcs11-devel - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-export-devel - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-export-libs - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-libs - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1, 9.18.34-1
bind-libs-lite - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-lite-devel - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-pkcs11 - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-license - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1, 9.18.34-1
bind-pkcs11-libs - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-pkcs11-utils - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-devel - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1, 9.18.34-1
bind-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1, 9.18.34-1
bind - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1, 9.18.34-1
bind-sdb - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-sdb-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1
bind-utils - addressed in versions 9.11.4-26.P2, 9.11.36-16.0.1, 9.18.34-1
bind-export-devel - update to 9.11.21-20
bind - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
bind-chroot - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
bind-debuginfo - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
bind-debugsource - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
bind-devel - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
bind-export-libs - update to 9.11.21-20
bind-libs - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
bind-libs-lite - update to 9.11.21-20
bind-pkcs11 - addressed in versions 9.11.21-20, 9.16.23-24
bind-pkcs11-devel - addressed in versions 9.11.21-20, 9.16.23-24
bind-utils - addressed in versions 9.11.21-20, 9.16.23-24, 9.18.21-4
python3-bind - addressed in versions 9.11.21-20, 9.16.23-24
libbind9-161 - update to 9.11.22-3.60.2
libisc1107-debuginfo - update to 9.11.22-3.60.2
libisccc161 - update to 9.11.22-3.60.2
libisccc161-debuginfo - update to 9.11.22-3.60.2
libisc1107 - update to 9.11.22-3.60.2
bind-utils - addressed in versions 9.11.22-3.60.2, 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1, 9.18.33-150600.3.6.1, 9.20.9-150700.3.3.1
python-bind - update to 9.11.22-3.60.2
bind-doc - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1, 9.18.33-150600.3.6.1, 9.20.9-150700.3.3.1
bind-debuginfo - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1, 9.18.33-150600.3.6.1, 9.20.9-150700.3.3.1
libisc1107-debuginfo-32bit - update to 9.11.22-3.60.2
libisc1107-32bit - update to 9.11.22-3.60.2
bind-debugsource - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1, 9.18.33-150600.3.6.1, 9.20.9-150700.3.3.1
libirs161-debuginfo - update to 9.11.22-3.60.2
liblwres161-debuginfo - update to 9.11.22-3.60.2
bind-utils-debuginfo - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1, 9.18.33-150600.3.6.1, 9.20.9-150700.3.3.1
libirs161 - update to 9.11.22-3.60.2
libdns1110 - update to 9.11.22-3.60.2
bind-chrootenv - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1
libisccfg163 - update to 9.11.22-3.60.2
bind - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1, 9.18.33-150600.3.6.1, 9.20.9-150700.3.3.1
libbind9-161-debuginfo - update to 9.11.22-3.60.2
libdns1110-debuginfo - update to 9.11.22-3.60.2
liblwres161 - update to 9.11.22-3.60.2
bind-devel - addressed in versions 9.11.22-3.60.2, 9.16.6-150300.22.50.1
libisccfg163-debuginfo - update to 9.11.22-3.60.2
python3-bind - update to 9.11.36-16.0.1
libisccc1600 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libisc1606 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libns1604-debuginfo - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libbind9-1600 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libns1604 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libirs1601 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libisccc1600-64bit - update to 9.16.6-150000.12.80.1
libdns1605 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libisccfg1600 - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1
libisccfg1600-64bit - update to 9.16.6-150000.12.80.1
libbind9-1600-64bit - update to 9.16.6-150000.12.80.1
libisc1606-64bit - update to 9.16.6-150000.12.80.1
libdns1605-64bit - update to 9.16.6-150000.12.80.1
libirs1601-64bit - update to 9.16.6-150000.12.80.1
python3-bind - addressed in versions 9.16.6-150000.12.80.1, 9.16.6-150300.22.50.1, 9.16.50-150400.5.46.1, 9.16.50-150500.8.24.1
libirs1601-debuginfo - update to 9.16.6-150300.22.50.1
libisccc1600-debuginfo - update to 9.16.6-150300.22.50.1
libbind9-1600-debuginfo - update to 9.16.6-150300.22.50.1
libisc1606-debuginfo - update to 9.16.6-150300.22.50.1
libisccfg1600-debuginfo - update to 9.16.6-150300.22.50.1
libdns1605-debuginfo - update to 9.16.6-150300.22.50.1
libirs-devel - update to 9.16.6-150300.22.50.1
bind9.16 (Red Hat package) - addressed in versions 9.16.23-0.7.el8_6.8, 9.16.23-0.14.el8_8.6, 9.16.23-0.22.el8_10.2
bind9.16-license - update to 9.16.23-0.22
python3-bind9.16 - update to 9.16.23-0.22
bind9.16 - update to 9.16.23-0.22
bind9.16-chroot - update to 9.16.23-0.22
bind9.16-devel - update to 9.16.23-0.22
bind9.16-dnssec-utils - update to 9.16.23-0.22
bind9.16-libs - update to 9.16.23-0.22
bind9.16-utils - update to 9.16.23-0.22
bind9.16-doc - update to 9.16.23-0.22
bind-pkcs11-libs - update to 9.16.23-24
bind-license - addressed in versions 9.16.23-24, 9.18.21-4
bind-dnssec-utils - addressed in versions 9.16.23-24, 9.18.21-4
bind-pkcs11-utils - update to 9.16.23-24
bind-dnssec-doc - addressed in versions 9.16.23-24, 9.18.21-4
bind9.18 (Red Hat package) - update to 9.18.29-1.el9_5.1
bind9 (Ubuntu package) - addressed in versions 1:9.18.30-0ubuntu0.20.04.2, 1:9.18.30-0ubuntu0.22.04.2, 1:9.18.30-0ubuntu0.24.04.2, 1:9.20.0-2ubuntu3.1
bind - update to 9.18.33
bind - addressed in versions 9.18.33-1.fc41, 9.18.33-1.fc42, 9.18.33-1.fc43
bind9 (Debian package) - update to 1:9.18.33-1~deb12u2
bind-dnssec-doc - update to 9.18.34-1
bind-dnssec-utils - update to 9.18.34-1
bind-doc - update to 9.18.34-1
SmartFabric OS10 - addressed in versions 10.5.4.15, 10.5.5.14, 10.5.6.9
Oracle Solaris - addressed in versions 11.3 ESU 36.34, 11.4 SRU 80
bind-dyndb-ldap - addressed in versions 11.10-33.fc41, 11.11-2.fc42, 11.11-2.fc43
PowerProtect Data Manager - update to 19.19.0-15

• https://kb.isc.org/docs/cve-2024-11187

• Ubuntu update for bind9
• Multiple vulnerabilities in ISC BIND
• Slackware Linux update for bind
• Debian update for bind9
• SUSE update for bind
• SUSE update for bind
• SUSE update for bind
• Fedora 43 update for bind, bind-dyndb-ldap
• Fedora 42 update for bind, bind-dyndb-ldap
• SUSE update for bind
• SUSE update for bind
• Fedora 41 update for bind, bind-dyndb-ldap
• SUSE update for bind
• openEuler 24.03 LTS SP1 update for bind
• openEuler 24.03 LTS update for bind
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 8 update for bind
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 9 update for bind9.18
• Red Hat Enterprise Linux 7 update for bind
• Red Hat Enterprise Linux 8 update for bind
• Red Hat Enterprise Linux 8 update for bind9.16
• Red Hat Enterprise Linux 8 update for bind9.16
• Red Hat Enterprise Linux 8 update for bind9.16
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 8 update for bind
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION update for bind
• Red Hat Enterprise Linux 8 update for bind
• Red Hat Enterprise Linux 8 update for bind
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for bind
• openEuler 22.03 LTS SP3 update for bind
• openEuler 22.03 LTS SP4 update for bind
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Multiple vulnerabilities in OpenShift Virtualization 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Anolis OS update for bind9.16
• Anolis OS update for bind
• Anolis OS update for bind
• openEuler update for dhcp
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Oracle Solaris update for third-party components
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• BIND denial of service in F5 BIG-IP
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in OpenShift Virtualization 4.16
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Anolis OS update for bind
• Multiple vulnerabilities in IBM Observability with Instana
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Submariner 0.18
• Juniper Secure Analytics update for third-party components
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell SmartFabric OS10
• Dell SmartFabric OS10 update for third-party components
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Dell Networking OS10 update for third-party components
• openEuler 20.03 LTS SP4 update for bind
• Multiple vulnerabilities in Dell PowerStoreT OS
• SUSE update for bind
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Dell SmartFabric Manager update for third-party components
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in Submariner 0.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM i
• Multiple vulnerabilities in Netcool Operations Insight
• Juniper Session Smart Router update for third-party components