Anat Bremler-Barr

يؤدي التباين بين مواصفات HTTP/2 والبنى الداخلية لبعض عمليات التنفيذ إلى حساب غير صحيح للتدفقات. من خلال فتح تدفقات وإجبار الخادم على إعادة الضبط بسرعة باستخدام إطارات غير صحيحة أو أخطاء في التحكم في التدفق، يمكن للمهاجم عن بُعد التسبب في استهلاك مفرط لموارد الخادم. يحدث ذلك لأن التدفقات التي يعيد الخادم ضبطها تُعتبر مغلقة على مستوى البروتوكول، على الرغم من استمرار المعالجة في الخلفية، مما يسمح للعميل بإجبار الخادم على التعامل مع عدد غير محدود من التدفقات المتزامنة في اتصال واحد. يمكن استخدام هذه المشكلة، التي أُطلق عليها اسم MadeYouReset، لشن هجمات حجب الخدمة (DoS) واسعة النطاق، كما أنها تتجاوز إجراءات التخفيف الخاصة بـ Rapid Reset من خلال خداع الخادم لإعادة تعيين عدادات التدفق الخاصة به. غالبًا ما يكون حركة مرور الهجوم

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات Apache Tomcat من 11.0.0-M1 حتى 11.0.9 إصدارات Apache Tomcat من 10.1.0-M1 حتى 10.1.43 إصدارات Apache Tomcat من 9.0.0.M1 حتى 9.0.107 الوصف: يؤدي خلل في إغلاق أو تحرير الموارد في Apache Tomcat إلى ظهور ثغرة أمنية تعرض النظام لهجوم «Made You Reset». قد تتأثر أيضًا الإصدارات الأقدم التي انتهى دعمها (end-of-life). التوصيات: قم بالتحديث إلى الإصدار 11.0.10 من Apache Tomcat. قم بالتحديث إلى الإصدار 10.1.44 من Apache Tomcat. قم بالتحديث إلى الإصدار 9.0.108 من Apache Tomcat.

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. A remote attacker could exploit this vulnerability to trigger an assertion failure by querying RFC 1918 reverse zones.

The effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This can lead to a denial of service, caused by a flaw that allows the named's configured cache size limit to be significantly exceeded, potentially exhausting all memory on the host.

The issue is related to a Non-Responsive Delegation Attack (NRDelegation Attack) that affects various DNS resolving software, including Unbound. This attack involves a malicious delegation with a considerable number of non-responsive nameservers, causing the resolver to spend significant time and resources resolving records under the malicious delegation point. Although Unbound does not suffer from high CPU usage, it still requires resources to resolve the malicious delegation, which can lead to degraded performance and potentially a denial of service in orchestrated attacks.

The issue is related to a flaw in the resolver code of the DNS server, which can be exploited by flooding the target resolver with queries, significantly impairing its performance and effectively denying legitimate clients access to the DNS resolution service. This can lead to a denial of service (DoS) attack. The vulnerability is associated with improper management of internal resources within the application when handling large delegations.

The issue in the DNS protocol allows malicious parties to use recursive DNS services to attack third-party authoritative name servers, resulting in degraded performance. This is triggered by random subdomains in the NSDNAME in NS records. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers.

The issue is related to a lack of effective limitation on the number of fetches performed when processing referrals, which can cause a recursing server to issue a large number of fetches. This can lead to degradation of the server's performance and potentially be exploited in a reflection attack with a high amplification factor. The vulnerability can be exploited by a remote attacker to trigger an assertion failure in tsig.c, causing a denial of service.

The issue is related to Insufficient Control of Network Message Volume, also known as an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.