Anat Bremler-Barr

A mismatch between HTTP/2 specifications and the internal architectures of some implementations leads to incorrect stream accounting. By opening streams and rapidly triggering the server to reset them using malformed frames or flow control errors, a remote attacker can cause excessive server resource consumption. This occurs because streams reset by the server are considered closed at the protocol level, while backend processing continues, allowing a client to force the server to handle an unbounded number of concurrent streams on a single connection. This issue, dubbed MadeYouReset, can be used to launch massive denial-of-service (DoS) attacks and bypasses existing Rapid Reset mitigations by tricking the server into resetting its own stream counters. The attack traffic often blends with legitimate traffic, making detection difficult.

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 11.0.0-M1 through 11.0.9 Apache Tomcat versions 10.1.0-M1 through 10.1.43 Apache Tomcat versions 9.0.0.M1 through 9.0.107 Description: A flaw in resource shutdown or release within Apache Tomcat creates a vulnerability to the “Made You Reset” attack. Older, end-of-life versions may also be affected. Recommendations: Upgrade to Apache Tomcat version 11.0.10. Upgrade to Apache Tomcat version 10.1.44. Upgrade to Apache Tomcat version 9.0.108.

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. A remote attacker could exploit this vulnerability to trigger an assertion failure by querying RFC 1918 reverse zones.

The effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This can lead to a denial of service, caused by a flaw that allows the named's configured cache size limit to be significantly exceeded, potentially exhausting all memory on the host.

The issue is related to a Non-Responsive Delegation Attack (NRDelegation Attack) that affects various DNS resolving software, including Unbound. This attack involves a malicious delegation with a considerable number of non-responsive nameservers, causing the resolver to spend significant time and resources resolving records under the malicious delegation point. Although Unbound does not suffer from high CPU usage, it still requires resources to resolve the malicious delegation, which can lead to degraded performance and potentially a denial of service in orchestrated attacks.

The issue is related to a flaw in the resolver code of the DNS server, which can be exploited by flooding the target resolver with queries, significantly impairing its performance and effectively denying legitimate clients access to the DNS resolution service. This can lead to a denial of service (DoS) attack. The vulnerability is associated with improper management of internal resources within the application when handling large delegations.

The issue in the DNS protocol allows malicious parties to use recursive DNS services to attack third-party authoritative name servers, resulting in degraded performance. This is triggered by random subdomains in the NSDNAME in NS records. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers.

The issue is related to a lack of effective limitation on the number of fetches performed when processing referrals, which can cause a recursing server to issue a large number of fetches. This can lead to degradation of the server's performance and potentially be exploited in a reflection attack with a high amplification factor. The vulnerability can be exploited by a remote attacker to trigger an assertion failure in tsig.c, causing a denial of service.

The issue is related to Insufficient Control of Network Message Volume, also known as an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.