PT-2024-1751
CVE-2023-50868
·
Published
2024-02-13
·
Updated
2026-10-21
Description by
CVSS 2.0
7.8
HighMetricsAV:N/AC:L/Au:N/C:N/I:N/A:C
Vulnerability Report
Name of the Vulnerable Software and Affected Versions
- BIND versions 9.16.48-1 through 9.18.24-1
- Unbound versions 1.19.1-alt1
- PDNS Recursor versions 4.8.6-1
- Knot Resolver versions 5.6.0-1+deb12u1
- systemd (affected versions not specified)
- dnsmasq (affected versions not specified)
- COBALT (affected versions not specified)
Description
Multiple vulnerabilities have been discovered in various DNS server implementations, including BIND, Unbound, PDNS Recursor, and Knot Resolver. A denial-of-service (DoS) vulnerability exists in BIND due to a flaw in query-handling code and a CPU exhaustion issue related to malformed DNSSEC records. A similar CPU exhaustion vulnerability affects DNSSEC-validating resolvers when processing specially crafted DNSSEC responses. Additionally, vulnerabilities have been identified in systemd, dnsmasq, and COBALT, though specific details are limited. A publicly disclosed vulnerability (CVE-2023-50868) exists in Microsoft DNS servers, impacting DNSSEC validation.
Recommendations
- Upgrade BIND to version 9.16.48-1 or 9.18.24-1.
- Upgrade Unbound to version 1.19.1-alt1.
- Upgrade PDNS Recursor to version 4.8.6-1.
- Upgrade Knot Resolver to version 5.6.0-1+deb12u1.
- Upgrade systemd to the latest available version.
- Upgrade dnsmasq to the latest available version.
- Upgrade COBALT to the latest available version.
- For systems using DNSSEC validation, consider upgrading to a version that addresses the NSEC3 processing issue.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾