Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited.
Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes.
If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome.
BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bind-sdb-chrootUpgrade bind9.16-utilsUpgrade bind-pkcs11-develUpgrade bind-utilsUpgrade bind9.16-docUpgrade bind9.16Upgrade bind-lite-develUpgrade python3-bindUpgrade bind9.16-develUpgrade bind9.16-licenseUpgrade bind-pkcs11-libsUpgrade bind-licenseUpgrade bind-chrootUpgrade bind-dnssec-utilsUpgrade bind9.16-dnssec-utilsUpgrade bind-sdbUpgrade bind-libsUpgrade bind-export-develUpgrade bind-dnssec-docUpgrade bind-pkcs11Upgrade bind9.16-libsUpgrade bind-export-libsUpgrade bind-pkcs11-utilsUpgrade bind-docUpgrade bind9.16-chrootUpgrade bind-develUpgrade bindUpgrade bind-libs-liteUpgrade python3-bind9.16 | May 15, 2023 | Jan 26, 2023 |
| Alpine Linux | — | Upgrade bind | Aug 22, 2024 | Jan 25, 2023 |
| Amazon Linux Ami 2 | — | Upgrade bind-libs-liteUpgrade bind-chrootUpgrade bind-pkcs11-utilsUpgrade bind-libsUpgrade bind-develUpgrade bind-export-develUpgrade bind-sdb-chrootUpgrade bind-sdbUpgrade bind-lite-develUpgrade bindUpgrade bind-pkcs11Upgrade bind-debuginfoUpgrade bind-pkcs11-libsUpgrade bind-export-libsUpgrade bind-utilsUpgrade bind-pkcs11-develUpgrade bind-license | Jan 10, 2025 | Jan 26, 2023 |
| Amazon_linux_2023 | — | Upgrade python3-bindUpgrade bind-pkcs11Upgrade bind-dlz-ldap-debuginfoUpgrade bind-dnssec-utilsUpgrade bind-debugsourceUpgrade bind-dlz-ldapUpgrade bind-dlz-mysql-debuginfoUpgrade bind-libs-debuginfoUpgrade bind-dlz-sqlite3-debuginfoUpgrade bind-dnssec-utils-debuginfoUpgrade bind-licenseUpgrade bindUpgrade bind-dlz-mysqlUpgrade bind-develUpgrade bind-pkcs11-develUpgrade bind-dlz-sqlite3Upgrade bind-libsUpgrade bind-pkcs11-libsUpgrade bind-dnssec-docUpgrade bind-debuginfoUpgrade bind-pkcs11-utilsUpgrade bind-pkcs11-libs-debuginfoUpgrade bind-dlz-filesystemUpgrade bind-pkcs11-utils-debuginfoUpgrade bind-pkcs11-debuginfoUpgrade bind-dlz-filesystem-debuginfoUpgrade bind-utilsUpgrade bind-chrootUpgrade bind-utils-debuginfo | Feb 17, 2025 | Jan 25, 2023 |
| Centos_linux | — | Upgrade python3-bind9.16Upgrade bind9.16Upgrade bind-pkcs11Upgrade bind-develUpgrade python3-bindUpgrade bind9.16-utilsUpgrade bind9.16-dnssec-utils-debuginfoUpgrade bind-libs-lite-debuginfoUpgrade bind-export-libs-debuginfoUpgrade bind9.16-utils-debuginfoUpgrade bind9.16-libs-debuginfoUpgrade bind9.16-dnssec-utilsUpgrade bind-libsUpgrade bind-pkcs11-libs-debuginfoUpgrade bind-dnssec-utils-debuginfoUpgrade bind9.16-chrootUpgrade bind9.16-debuginfoUpgrade bind-debuginfoUpgrade bind-pkcs11-develUpgrade bind-pkcs11-utils-debuginfoUpgrade bind9.16-debugsourceUpgrade bind-pkcs11-libsUpgrade bind-chrootUpgrade bind-lite-develUpgrade bind-utilsUpgrade bind-sdbUpgrade bind-pkcs11-debuginfoUpgrade bind-utils-debuginfoUpgrade bind-dnssec-docUpgrade bind9.16-licenseUpgrade bind-libs-debuginfoUpgrade bind-dnssec-utilsUpgrade bind-licenseUpgrade bind-libs-liteUpgrade bind-sdb-chrootUpgrade bindUpgrade bind9.16-libsUpgrade bind-sdb-debuginfoUpgrade bind-pkcs11-utilsUpgrade bind-export-libsUpgrade bind-export-develUpgrade bind-debugsource | May 15, 2023 | Jan 26, 2023 |
| Debian | — | Upgrade bind9 | Jan 30, 2023 | Jan 26, 2023 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Mar 7, 2023 | Jan 26, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-bindUpgrade bind-pkcs11-utilsUpgrade bind-chrootUpgrade bind-dnssec-docUpgrade bind-pkcs11Upgrade bind-utilsUpgrade bind-dnssec-utilsUpgrade bind-pkcs11-libsUpgrade bind-libsUpgrade bindUpgrade bind-license | May 8, 2023 | Jan 26, 2023 |
| Ibm Aix | — | Apply the fix or workaround for bind_advisory23 | Jul 27, 2023 | Jan 26, 2023 |
| Oracle_linux | — | Upgrade bind-pkcs11-develUpgrade bind-export-libsUpgrade python3-bindUpgrade bind-licenseUpgrade bind-libsUpgrade bind-dnssec-utilsUpgrade python3-bind9.16Upgrade bind-export-develUpgrade bind9.16-utilsUpgrade bind9.16-dnssec-utilsUpgrade bind9.16Upgrade bind-sdb-chrootUpgrade bind9.16-licenseUpgrade bind9.16-chrootUpgrade bind-utilsUpgrade bind-docUpgrade bind-sdbUpgrade bind-pkcs11Upgrade bind-lite-develUpgrade bind9.16-libsUpgrade bind9.16-develUpgrade bind-develUpgrade bindUpgrade bind-pkcs11-utilsUpgrade bind-chrootUpgrade bind-dnssec-docUpgrade bind-libs-liteUpgrade bind9.16-docUpgrade bind-pkcs11-libs | May 18, 2023 | Jan 25, 2023 |
| Redhat_linux | — | Upgrade dhcp-libs-debuginfoUpgrade bind9.16-licenseUpgrade bind-libs-debuginfoUpgrade bind9.16-utilsUpgrade bind9.16-debuginfoUpgrade dhcp-debugsourceUpgrade bind-sdb-chrootUpgrade dhcp-debuginfoUpgrade bind-licenseUpgrade bind-pkcs11-libsUpgrade bind9.16-docUpgrade bind-export-libsUpgrade dhcp-serverUpgrade dhcp-clientUpgrade bind9.16-libsUpgrade bind-dnssec-utils-debuginfoUpgrade python3-bindUpgrade bind-pkcs11-utils-debuginfoUpgrade bind9.16-debugsourceUpgrade bind-pkcs11-debuginfoNo solution existsUpgrade bind-pkcs11-libs-debuginfoUpgrade bind9.16-dnssec-utils-debuginfoUpgrade python3-bind9.16Upgrade dhcp-relay-debuginfoUpgrade bind-sdb-debuginfoUpgrade dhcp-relayUpgrade dhcp-commonUpgrade bind-pkcs11-develUpgrade dhcp-client-debuginfoUpgrade bind-docUpgrade bind-sdbUpgrade bind-export-libs-debuginfoUpgrade bind-pkcs11-utilsUpgrade bind-debuginfoUpgrade bind9.16-utils-debuginfoUpgrade bind-debugsourceUpgrade bind9.16-develUpgrade bind-dnssec-docUpgrade bind9.16-chrootUpgrade bind-utilsUpgrade bind9.16-libs-debuginfoUpgrade bind-export-develUpgrade bind-pkcs11Upgrade bind-chrootUpgrade bind-utils-debuginfoUpgrade bindUpgrade bind-develUpgrade bind-libsUpgrade bind-dnssec-utilsUpgrade bind-lite-develUpgrade bind9.16Upgrade bind-libs-liteUpgrade dhcp-server-debuginfoUpgrade dhcp-libsUpgrade bind-libs-lite-debuginfoUpgrade bind9.16-dnssec-utils | May 15, 2023 | Jan 26, 2023 |
| Suse | — | Upgrade libisc1606Upgrade libisccfg1600Upgrade libdns1605Upgrade bind-utilsUpgrade libirs1601Upgrade libisccc1600Upgrade libns1604Upgrade python3-bindUpgrade bind-chrootenvUpgrade bind-docUpgrade libirs-develUpgrade bindUpgrade libbind9-1600Upgrade bind-devel | Feb 13, 2023 | Jan 26, 2023 |
| Ubuntu | — | Upgrade bind9 | Mar 22, 2023 | Jan 26, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub