NA

CVE-2023-3341

Published: 20/09/2023 Updated: 16/02/2024
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the malicious user to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 up to and including 9.16.43, 9.18.0 up to and including 9.18.18, 9.19.0 up to and including 9.19.16, 9.9.3-S1 up to and including 9.16.43-S1, and 9.18.0-S1 up to and including 9.18.18-S1.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.11.7

isc bind 9.11.3

isc bind 9.11.6

isc bind 9.10.5

isc bind 9.11.5

isc bind 9.9.3

isc bind 9.10.7

isc bind 9.11.12

isc bind 9.11.8

isc bind 9.9.12

isc bind 9.9.13

isc bind 9.11.21

isc bind 9.16.8

isc bind 9.16.11

isc bind 9.11.27

isc bind 9.16.13

isc bind 9.11.29

isc bind 9.16.21

isc bind 9.11.35

isc bind 9.11.37

isc bind 9.16.32

isc bind 9.16.14

isc bind 9.16.36

isc bind 9.11.4

isc bind 9.16.12

isc bind

isc bind 9.16.43

isc bind 9.18.18

isc bind 9.18.0

fedoraproject fedora 37

fedoraproject fedora 38

debian debian linux 10.0

debian debian linux 11.0

Vendor Advisories

Debian Bug report logs - #1052416 bind9: CVE-2023-3341 Package: src:bind9; Maintainer for src:bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 21 Sep 2023 17:27:02 UTC Severity: grave Tags: security, upstream Found in versions bind9/1:91816-1~ ...
Debian Bug report logs - #1052417 bind9: CVE-2023-4236 Package: src:bind9; Maintainer for src:bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 21 Sep 2023 17:27:06 UTC Severity: grave Tags: security, upstream Found in versions bind9/1:91816-1, ...
Several vulnerabilities were discovered in BIND, a DNS server implementation CVE-2023-3341 A stack exhaustion flaw was discovered in the control channel code which may result in denial of service (named daemon crash) CVE-2023-4236 Robert Story discovered that a flaw in the networking code handling DNS-over-TLS queries could cause ...
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly Since e ...
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly Since e ...
Description<!---->A flaw was found in the Bind package The code that processes control channel messages sent to named calls certain functions recursively during packet parsing Recursion depth is only limited by the maximum accepted packet size Depending on the environment, this may cause the packet-parsing code to run out of available stack memo ...
概要 Important: OpenShift Container Platform 41317 bug fix and security update タイプ/重大度 Security Advisory: Important トピック Red Hat OpenShift Container Platform release 41317 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Ha ...
Synopsis Important: OpenShift Virtualization 4128 Images security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4128 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact o ...
Synopsis Important: bind916 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind916 is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has ra ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat Product Security has ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rated this ...
Synopsis Important: Migration Toolkit for Applications security update Type/Severity Security Advisory: Important Topic An update is now available for MTA-61-RHEL-8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update Support, Red Hat Enterprise Li ...
Synopsis Important: bind916 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind916 is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having ...
Synopsis Important: OpenShift Virtualization 4117 Images security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4117 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a secur ...
Synopsis Important: Red Hat OpenShift Service Mesh for 238 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Service Mesh 23 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base sc ...
Synopsis Important: Red Hat OpenShift Service Mesh for 2211 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Service Mesh 22 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base s ...
Synopsis Important: RHACS 41 enhancement and security update Type/Severity Security Advisory: Important Topic Updated images are now available for Red Hat Advanced Cluster Security (RHACS) The updated image includes new features and bug fixesRed Hat Product Security has rated this update as having a security impact of Important A Common V ...
Synopsis Important: Service Telemetry Framework 152 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 152Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Important: Self Node Remediation Operator 051 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Self Node Remediation Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Important: Red Hat OpenShift Service Mesh for 244 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Service Mesh 24 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base sc ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise Linux 82 Telecommu ...
Synopsis Important: Node Health Check Operator 041 Type/Severity Security Advisory: Important Topic This is an updated version of the Node Health Check Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Important: OpenShift Container Platform 41152 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41152 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: OpenShift Container Platform 41239 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41239 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has rated this ...
Synopsis Important: Red Hat OpenShift Pipelines Operator security update Type/Severity Security Advisory: Important Topic An update is now available for OpenShift-Pipelines-111-RHEL-8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Important: OpenShift Virtualization 4135 Images security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4135 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact o ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a securi ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a securi ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a securi ...
Synopsis Important: Red Hat OpenShift Pipelines 1106 release and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Pipelines 1106 has been releasedRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Important: Node Health Check Operator 061 security update Type/Severity Security Advisory: Important Topic This is an updated version for the node-healthcheck-must-gather-container, the node-healthcheck-operator-bundle-container, the node-healthcheck-operator-container, and the node-remediation-console-container It is now availabl ...