Resource exhaustion in ISC BIND - CVE-2023-4408

Vulnerability identifier: #VU86383

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-4408

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing DNS messages. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

ISC BIND
PowerStore 9000X
PowerStore 1000X
PowerStore 3000X
PowerStore 7000X
PowerStore 5000X
SmartFabric Storage Software
PowerStoreX OS
Oracle Linux
Debian Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Anolis OS
SUSE Enterprise Storage
IBM AIX
IBM i
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Basesystem Module
Server Applications Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Oracle Solaris
OpenShift Service Mesh
OpenShift Virtualization
IBM VIOS
Red Hat OpenShift Container Platform
RecoverPoint for Virtual Machines
IBM Qradar SIEM
IBM Spectrum Symphony
Ansible Automation Platform
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Session Smart Router
Red Hat Migration Toolkit for Applications
Azure Stack
IBM Observability with Instana
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libuv1-debuginfo
libuv1
libuv-debugsource
libuv-devel
bind-dyndb-ldap (Red Hat package)
dhcp
dhclient
dhcp-devel
dhcp-libs
dhcp-common
dhcp (Red Hat package)
dhcp-relay
dhcp-client
dhcp-server
dhcp-devel-doc
bind (Red Hat package) main
bind
bind-pkcs11-libs
bind-pkcs11-devel
bind-license
bind-sdb-chroot
bind-utils
bind-sdb
bind-export-libs
bind-chroot
bind-devel
bind-pkcs11
bind-lite-devel
bind-libs-lite
bind-pkcs11-utils
bind-export-devel
bind-libs
python3-bind
libisccc1600
bind-doc
bind-debuginfo
libisccfg1600-debuginfo
libisccfg1600
libisc1606
libdns1605-debuginfo
libirs1601
libbind9-1600
libirs1601-64bit
libisccc1600-64bit
libns1604-debuginfo
libirs1601-debuginfo
libisc1606-debuginfo
libdns1605
bind-debugsource
libisccc1600-debuginfo
bind-chrootenv
libirs-devel
bind-utils-debuginfo
libbind9-1600-debuginfo
libns1604
libbind9-1600-64bit
libdns1605-64bit
libisccfg1600-64bit
libisc1606-64bit
bind9.16 (Red Hat package)
python3-bind9.16
bind9.16-license
bind9.16-doc
bind9.16-utils
bind9.16-libs
bind9.16-dnssec-utils
bind9.16-devel
bind9.16-chroot
bind9.16
bind-dnssec-doc
bind-dnssec-utils
bind9 (Ubuntu package)
bind9 (Debian package)
bind9-next
bind-dyndb-ldap
Juniper Junos Space
Red Hat OpenShift GitOps
IBM Integrated Analytics System
PowerProtect DP Series Appliance (IDPA)
Technical Support Appliance
PowerStore T
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
Storage Virtualize
EMC Cloud Tiering Appliance
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

ISC BIND - addressed in versions 9.16.48, 9.16.48-S1, 9.18.24, 9.18.24-S1, 9.19.21
SmartFabric Storage Software - update to 1.4.3
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.1, 2.5.2
OpenShift Virtualization - addressed in versions 4.14.5, 4.14.6
Red Hat OpenShift Container Platform - addressed in versions 4.12.57, 4.13.42, 4.13.45, 4.14.32, 4.14.33, 4.15.10, 4.15.13
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
IBM Spectrum Symphony - update to 7.3.2 FP3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Red Hat Single Sign-On - addressed in versions 7.6.8, 7.6.9
Juniper Junos Space - update to 24.1R2
Red Hat OpenShift GitOps - addressed in versions 1.10.5, 1.10.6, 1.11.4, 1.11.5, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.13.1
libuv1-debuginfo - update to 1.18.0-150000.3.2.1
libuv1 - update to 1.18.0-150000.3.2.1
libuv-debugsource - update to 1.18.0-150000.3.2.1
libuv-devel - update to 1.18.0-150000.3.2.1
bind-dyndb-ldap (Red Hat package) - addressed in versions 2.3-8.el6_10.1, 11.1-7.el7_9.1, 11.9-7.el9_0.1, 11.9-8.el9_2.2, 11.9-8.el9_3.3
Ansible Automation Platform - update to 2.4
PowerProtect DP Series Appliance (IDPA) - update to 2.7.7
Technical Support Appliance - update to 3.0.1
PowerStoreX OS - update to 3.2.1.5-2424458
PowerStore T - update to 3.6.1.4-2413340
dhcp - update to 4.2.5-83
dhclient - update to 4.2.5-83
dhcp-devel - update to 4.2.5-83
dhcp-libs - addressed in versions 4.2.5-83, 4.3.6-50.0.1
dhcp-common - addressed in versions 4.2.5-83, 4.3.6-50.0.1
dhcp (Red Hat package) - addressed in versions 4.2.5-83.el7_9.2, 4.3.6-40.el8_2.3, 4.3.6-44.el8_4.3, 4.3.6-47.el8_6.2, 4.3.6-49.el8_8.1, 4.3.6-49.el8_9.1, 4.3.6-50.el8_10
dhcp-relay - update to 4.3.6-50.0.1
dhcp-client - update to 4.3.6-50.0.1
dhcp-server - update to 4.3.6-50.0.1
dhcp-devel-doc - update to 4.3.6-50.0.1
IBM Cloud Pak for Watson AIOps - update to 4.6.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Session Smart Router - addressed in versions 6.2.10, 6.3.7
Red Hat Migration Toolkit for Applications - update to 7.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF03
Storage Virtualize - addressed in versions 8.4.0.15, 8.5.0.13, 8.6.0.5, 8.7.0.0
IBM Integrated Analytics System - update to 8.8.24.10.SP1
bind (Red Hat package) main - addressed in versions 9.8.2-0.68.rc1.el6_10.14, 9.11.4-26.P2.el7_9.16, 9.11.13-6.el8_2.7, 9.11.26-4.el8_4.4, 9.11.36-3.el8_6.7, 9.11.36-8.el8_8.4, 9.11.36-11.el8_9.1, 9.11.36-14.el8_10, 9.16.23-1.el9_0.5, 9.16.23-11.el9_2.4, 9.16.23-14.el9_3.4, 9.16.23-18.el9_4.1
bind - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-pkcs11-libs - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-pkcs11-devel - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-license - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-sdb-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-utils - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-sdb - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-export-libs - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-devel - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-pkcs11 - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-lite-devel - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-libs-lite - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-pkcs11-utils - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-export-devel - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
bind-libs - addressed in versions 9.11.4-26.P2, 9.11.36-14.0.1
python3-bind - update to 9.11.36-14.0.1
libisccc1600 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-doc - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
bind-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
libisccfg1600-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
libisccfg1600 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libisc1606 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-utils - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
libdns1605-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libirs1601 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libbind9-1600 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libirs1601-64bit - update to 9.16.6-150000.12.74.2
libisccc1600-64bit - update to 9.16.6-150000.12.74.2
libns1604-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libirs1601-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
python3-bind - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
libisc1606-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libdns1605 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-debugsource - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
libisccc1600-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-chrootenv - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-devel - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libirs-devel - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-utils-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1
libbind9-1600-debuginfo - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libns1604 - addressed in versions 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
libbind9-1600-64bit - update to 9.16.6-150000.12.74.2
libdns1605-64bit - update to 9.16.6-150000.12.74.2
libisccfg1600-64bit - update to 9.16.6-150000.12.74.2
libisc1606-64bit - update to 9.16.6-150000.12.74.2
bind9.16 (Red Hat package) - addressed in versions 9.16.23-0.7.el8_6.5, 9.16.23-0.14.el8_8.4, 9.16.23-0.16.el8_9.2
python3-bind9.16 - update to 9.16.23-0.14
bind9.16-license - update to 9.16.23-0.14
bind9.16-doc - update to 9.16.23-0.14
bind9.16-utils - update to 9.16.23-0.14
bind9.16-libs - update to 9.16.23-0.14
bind9.16-dnssec-utils - update to 9.16.23-0.14
bind9.16-devel - update to 9.16.23-0.14
bind9.16-chroot - update to 9.16.23-0.14
bind9.16 - update to 9.16.23-0.14
bind-pkcs11 - addressed in versions 9.16.23-21, 9.16.23-22
bind-pkcs11-utils - addressed in versions 9.16.23-21, 9.16.23-22
bind - addressed in versions 9.16.23-21, 9.16.23-22
bind-dnssec-doc - addressed in versions 9.16.23-21, 9.16.23-22
bind-license - addressed in versions 9.16.23-21, 9.16.23-22
python3-bind - addressed in versions 9.16.23-21, 9.16.23-22
bind-chroot - addressed in versions 9.16.23-21, 9.16.23-22
bind-pkcs11-devel - addressed in versions 9.16.23-21, 9.16.23-22
bind-pkcs11-libs - addressed in versions 9.16.23-21, 9.16.23-22
bind-devel - addressed in versions 9.16.23-21, 9.16.23-22
bind-utils - addressed in versions 9.16.23-21, 9.16.23-22
bind-debuginfo - addressed in versions 9.16.23-21, 9.16.23-22
bind-debugsource - addressed in versions 9.16.23-21, 9.16.23-22
bind-dnssec-utils - addressed in versions 9.16.23-21, 9.16.23-22
bind-libs - addressed in versions 9.16.23-21, 9.16.23-22
bind - update to 9.16.48
bind9 (Ubuntu package) - addressed in versions 1:9.16.48-0ubuntu0.20.04.1, 1:9.18.18-0ubuntu0.22.04.2, 1:9.18.18-0ubuntu2.1
bind9 (Debian package) - addressed in versions 1:9.16.48-1, 1:9.18.24-1
bind - update to 9.16.48-1
bind - addressed in versions 9.18.24-1.fc38, 9.18.24-1.fc39, 9.18.24-1.fc41
bind9-next - addressed in versions 9.19.21-1.fc38, 9.19.21-1.fc39
Azure Stack - update to 10.2402
bind-dyndb-ldap - update to 11.1-7
Oracle Solaris - addressed in versions 11.3 ESU 36.33, 11.4 SRU 68
bind-dyndb-ldap - addressed in versions 11.10-23.fc38, 11.10-24.fc39, 11.10-27.fc41
EMC Cloud Tiering Appliance - update to 13.2.0.2.31
IBM Observability with Instana - update to 272

• https://kb.isc.org/docs/cve-2023-4408

• Multiple vulnerabilities in ISC BIND
• Ubuntu update for bind9
• Slackware Linux update for bind
• Fedora 39 update for bind9-next
• Fedora 38 update for bind9-next
• Fedora 41 update for bind, bind-dyndb-ldap
• Fedora 39 update for bind, bind-dyndb-ldap
• Fedora 38 update for bind, bind-dyndb-ldap
• SUSE update for bind
• SUSE update for bind
• Ubuntu update for bind9
• Multiple vulnerabilities in IBM i
• openEuler 22.03 LTS update for bind
• openEuler 22.03 LTS SP1 update for bind
• openEuler 22.03 LTS SP2 update for bind
• openEuler 22.03 LTS SP3 update for bind
• Red Hat Enterprise Linux 8.6 Extended Update Support update for bind9.16
• Red Hat Enterprise Linux 8.8 Extended Update Support update for bind9.16
• Red Hat Enterprise Linux 8 update for bind9.16
• Red Hat Enterprise Linux 8 update for bind and dhcp
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 9 update for bind
• Red Hat Enterprise Linux 9.2 update for bind
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Red Hat Enterprise Linux 9 update for bind
• Multiple vulnerabilities in IBM AIX and IBM VIOS
• Red Hat Enterprise Linux 8.6 Extended Update Support update for bind and dhcp
• Red Hat Enterprise Linux 8.8 Extended Update Support update for bind and dhcp
• Red Hat Enterprise Linux 8 update for bind and dhcp
• Red Hat Enterprise Linux 8.2 Advanced Update Support update for bind
• Red Hat Enterprise Linux 8 update for bind and dhcp
• SUSE update for bind
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure and Dell APEX Cloud Platform Foundation Software
• SUSE update for bind
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Red Hat Enterprise Linux 7 update for bind, bind-dyndb-ldap, and dhcp
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Observability with Instana
• Debian update for bind9
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Amazon Linux AMI update for bind
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Storage Virtualize
• IBM Integrated Analytics System update for BIND
• Multiple vulnerabilities in IBM Technical Support Appliance
• Multiple vulnerabilities in Dell PowerStore T
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION update for bind and bind-dyndb-ldap
• Multiple vulnerabilities in Junos Space
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell PowerProtect DP Series Appliance (IDPA)
• Anolis OS update for bind and dhcp
• Anolis OS update for bind9.16
• Anolis OS update for multiple packages
• Dell SmartFabric Storage Software update for third-party components
• Dell RecoverPoint for Virtual Machines update for third-party components
• Multiple vulnerabilities in Dell PowerStore X
• Multiple vulnerabilities in IBM Spectrum Symphony
• Juniper Session Smart Router update for third-party components
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11