ISC Releases Security Patches for New BIND DNS Software Vulnerabilities

Jan 28, 2023Ravie LakshmananServer Security / DNS

The Internet Systems Consortium (ISC) has released patches to address multiple security vulnerabilities in the Berkeley Internet Name Domain (BIND) 9 Domain Name System (DNS) software suite that could lead to a denial-of-service (DoS) condition.

“A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions and system failures,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory released Friday.

The open source software is used by major financial firms, national and international carriers, internet service providers (ISPs), retailers, manufacturers, educational institutions, and government entities, according to its website.

All four flaws reside in named, a BIND9 service that functions as an authoritative nameserver for a fixed set of DNS zones or as a recursive resolver for clients on a local network.

The list of the bugs, which are rated 7.5 on the CVSS scoring system, is as follows –

• CVE-2022-3094 – An UPDATE message flood may cause named to exhaust all available memory
• CVE-2022-3488 – BIND Supported Preview Edition named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries
• CVE-2022-3736 – named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries
• CVE-2022-3924 – named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

Successful exploitation of the vulnerabilities could cause the named service to crash or exhaust available memory on a target server.

The issues affect versions 9.16.0 to 9.16.36, 9.18.0 to 9.18.10, 9.19.0 to 9.19.8, and 9.16.8-S1 to 9.16.36-S1. CVE-2022-3488 also impacts BIND Supported Preview Edition versions 9.11.4-S1 to 9.11.37-S1. They have been resolved in versions 9.16.37, 9.18.11, 9.19.9, and 9.16.37-S1.

Although there is no evidence that any of these vulnerabilities are being actively exploited, users are recommended to upgrade to the latest version as soon as possible to mitigate potential threats.