Resource exhaustion in ISC BIND - CVE-2024-0760

Vulnerability identifier: #VU94709

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-0760

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion by sending a flood of DNS messages over TCP and perform a denial of service (DoS) attack.

ISC BIND
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
IBM i
Slackware Linux
Server Applications Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
SmartFabric Storage Software
IBM Spectrum Symphony
IBM Cloud Pak for Business Automation
python3-bind
bind
bind-license
bind-dnssec-doc
bind-utils
bind-pkcs11-utils
bind-pkcs11-libs
bind-pkcs11-devel
bind-pkcs11
bind-dnssec-utils
bind-devel
bind-debugsource
bind-debuginfo
bind-chroot
bind-libs
bind9 (Debian package)
bind9 (Ubuntu package)
bind-utils-debuginfo
bind-doc
bind-dyndb-ldap

Install updates from vendor's website.

ISC BIND - addressed in versions 9.18.28, 9.18.28-S1, 9.20.0
SmartFabric Storage Software - update to 1.4.3
IBM Spectrum Symphony - update to 7.3.2 FP3
python3-bind - update to 9.16.23-23
bind - addressed in versions 9.16.23-23, 9.18.21-3
bind-license - addressed in versions 9.16.23-23, 9.18.21-3
bind-dnssec-doc - addressed in versions 9.16.23-23, 9.18.21-3
bind-utils - addressed in versions 9.16.23-23, 9.18.21-3
bind-pkcs11-utils - update to 9.16.23-23
bind-pkcs11-libs - update to 9.16.23-23
bind-pkcs11-devel - update to 9.16.23-23
bind-pkcs11 - update to 9.16.23-23
bind-dnssec-utils - addressed in versions 9.16.23-23, 9.18.21-3
bind-devel - addressed in versions 9.16.23-23, 9.18.21-3
bind-debugsource - addressed in versions 9.16.23-23, 9.18.21-3
bind-debuginfo - addressed in versions 9.16.23-23, 9.18.21-3
bind-chroot - addressed in versions 9.16.23-23, 9.18.21-3
bind-libs - addressed in versions 9.16.23-23, 9.18.21-3
bind9 (Debian package) - addressed in versions 1:9.16.50-1~deb11u1, 1:9.18.28-1~deb12u1
bind - update to 9.18.28
bind9 (Ubuntu package) - addressed in versions 1:9.18.28-0ubuntu0.20.04.1, 1:9.18.28-0ubuntu0.22.04.1, 1:9.18.28-0ubuntu0.24.04.1
bind - addressed in versions 9.18.28-2.fc39, 9.18.28-2.fc40, 9.18.28-2.fc41
bind-utils - update to 9.18.28-150600.3.3.1
bind-utils-debuginfo - update to 9.18.28-150600.3.3.1
bind-doc - update to 9.18.28-150600.3.3.1
bind - update to 9.18.28-150600.3.3.1
bind-debuginfo - update to 9.18.28-150600.3.3.1
bind-debugsource - update to 9.18.28-150600.3.3.1
bind-dyndb-ldap - addressed in versions 11.10-26.fc39, 11.10-29.fc40, 11.10-30.fc41
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1

• https://kb.isc.org/docs/cve-2024-0760
• http://www.openwall.com/lists/oss-security/2024/07/23/1

• Multiple vulnerabilities in ISC BIND
• Ubuntu update for bind9
• Slackware Linux update for bind
• Debian update for bind9
• SUSE update for bind
• Fedora 41 update for bind, bind-dyndb-ldap
• Fedora 39 update for bind, bind-dyndb-ldap
• Fedora 40 update for bind, bind-dyndb-ldap
• openEuler 22.03 LTS SP3 update for bind
• openEuler 22.03 LTS SP1 update for bind
• openEuler 24.03 LTS update for bind
• openEuler 22.03 LTS SP4 update for bind
• Multiple vulnerabilities in IBM i
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in IBM Spectrum Symphony