Reachable Assertion in ISC BIND - CVE-2023-5679

Vulnerability identifier: #VU86381

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-5679

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion caused by a bad interaction between DNS64 and serve-stale. A remote attacker can query a DNS64-enabled resolver for domain names triggering serve-stale.

ISC BIND
Oracle Linux
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
IBM i
IBM AIX
Red Hat CodeReady Linux Builder for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Slackware Linux
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Oracle Solaris
SmartFabric Storage Software
IBM VIOS
OpenShift Virtualization
OpenShift Service Mesh
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
bind9.16 (Red Hat package)
bind9.16-dnssec-utils
bind9.16-libs
python3-bind9.16
bind9.16-license
bind9.16-doc
bind9.16-utils
bind9.16
bind9.16-chroot
bind9.16-devel
bind (Red Hat package) main
bind-pkcs11-devel
bind-dnssec-doc
bind-license
python3-bind
bind-debugsource
bind-pkcs11-libs
bind-dnssec-utils
bind-utils
bind-pkcs11-utils
bind-debuginfo
bind-devel
bind-libs
bind-chroot
bind-pkcs11
bind
bind9 (Debian package)
bind-utils-debuginfo
bind-doc
bind9 (Ubuntu package)
bind9-next
bind-dyndb-ldap (Red Hat package)
bind-dyndb-ldap
Storage Virtualize
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
Juniper Junos Space
Dell EMC Storage Monitoring and Reporting (SMR)
Azure Stack
IBM Observability with Instana

Install updates from vendor's website.

ISC BIND - addressed in versions 9.16.48, 9.16.48-S1, 9.18.24, 9.18.24-S1, 9.19.21
SmartFabric Storage Software - update to 1.4.3
OpenShift Virtualization - addressed in versions 4.14.5, 4.14.6
Red Hat OpenShift Container Platform - update to 4.15.10
Storage Virtualize - addressed in versions 8.7.0.3, 8.7.2.0
Juniper Junos Space - update to 24.1R2
OpenShift Service Mesh - update to 2.5.2
IBM Cloud Pak for Watson AIOps - update to 4.6.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Storage Resource Manager - update to 5.0.1.0
bind9.16 (Red Hat package) - addressed in versions 9.16.23-0.7.el8_6.5, 9.16.23-0.14.el8_8.4, 9.16.23-0.16.el8_9.2
bind9.16-dnssec-utils - update to 9.16.23-0.14
bind9.16-libs - update to 9.16.23-0.14
python3-bind9.16 - update to 9.16.23-0.14
bind9.16-license - update to 9.16.23-0.14
bind9.16-doc - update to 9.16.23-0.14
bind9.16-utils - update to 9.16.23-0.14
bind9.16 - update to 9.16.23-0.14
bind9.16-chroot - update to 9.16.23-0.14
bind9.16-devel - update to 9.16.23-0.14
bind (Red Hat package) main - addressed in versions 9.16.23-1.el9_0.5, 9.16.23-11.el9_2.4, 9.16.23-14.el9_3.4, 9.16.23-18.el9_4.1
bind-pkcs11-devel - addressed in versions 9.16.23-21, 9.16.23-22
bind-dnssec-doc - addressed in versions 9.16.23-21, 9.16.23-22
bind-license - addressed in versions 9.16.23-21, 9.16.23-22
python3-bind - addressed in versions 9.16.23-21, 9.16.23-22
bind-debugsource - addressed in versions 9.16.23-21, 9.16.23-22
bind-pkcs11-libs - addressed in versions 9.16.23-21, 9.16.23-22
bind-dnssec-utils - addressed in versions 9.16.23-21, 9.16.23-22
bind-utils - addressed in versions 9.16.23-21, 9.16.23-22
bind-pkcs11-utils - addressed in versions 9.16.23-21, 9.16.23-22
bind-debuginfo - addressed in versions 9.16.23-21, 9.16.23-22
bind-devel - addressed in versions 9.16.23-21, 9.16.23-22
bind-libs - addressed in versions 9.16.23-21, 9.16.23-22
bind-chroot - addressed in versions 9.16.23-21, 9.16.23-22
bind-pkcs11 - addressed in versions 9.16.23-21, 9.16.23-22
bind - addressed in versions 9.16.23-21, 9.16.23-22
bind - update to 9.16.48
bind - update to 9.16.48-1
bind9 (Debian package) - addressed in versions 1:9.16.48-1, 1:9.18.24-1
bind-utils-debuginfo - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind-utils - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind-debugsource - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
python3-bind - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind-debuginfo - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind-doc - addressed in versions 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind9 (Ubuntu package) - addressed in versions 1:9.18.18-0ubuntu0.22.04.2, 1:9.18.18-0ubuntu2.1
bind - addressed in versions 9.18.24-1.fc38, 9.18.24-1.fc39, 9.18.24-1.fc41
bind9-next - addressed in versions 9.19.21-1.fc38, 9.19.21-1.fc39
Azure Stack - update to 10.2402
Oracle Solaris - addressed in versions 11.3 ESU 36.33, 11.4 SRU 68
bind-dyndb-ldap (Red Hat package) - addressed in versions 11.9-7.el9_0.1, 11.9-8.el9_2.2, 11.9-8.el9_3.3
bind-dyndb-ldap - addressed in versions 11.10-23.fc38, 11.10-24.fc39, 11.10-27.fc41
IBM Observability with Instana - update to 272

• https://kb.isc.org/docs/cve-2023-5679

• Multiple vulnerabilities in ISC BIND
• Ubuntu update for bind9
• Slackware Linux update for bind
• Fedora 39 update for bind9-next
• Fedora 38 update for bind9-next
• Fedora 41 update for bind, bind-dyndb-ldap
• Fedora 39 update for bind, bind-dyndb-ldap
• Fedora 38 update for bind, bind-dyndb-ldap
• SUSE update for bind
• SUSE update for bind
• Multiple vulnerabilities in IBM i
• openEuler 22.03 LTS update for bind
• openEuler 22.03 LTS SP1 update for bind
• openEuler 22.03 LTS SP2 update for bind
• openEuler 22.03 LTS SP3 update for bind
• Red Hat Enterprise Linux 8.6 Extended Update Support update for bind9.16
• Red Hat Enterprise Linux 8.8 Extended Update Support update for bind9.16
• Red Hat Enterprise Linux 8 update for bind9.16
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 9.2 update for bind
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Red Hat Enterprise Linux 9 update for bind
• Multiple vulnerabilities in IBM AIX and IBM VIOS
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure and Dell APEX Cloud Platform Foundation Software
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in IBM Observability with Instana
• Debian update for bind9
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Amazon Linux AMI update for bind
• Multiple vulnerabilities in Junos Space
• Multiple vulnerabilities in IBM Storage Virtualize
• Anolis OS update for bind9.16
• Dell SmartFabric Storage Software update for third-party components