ELSA-2025-1681

Опубликовано: 20 фев. 2025

Источник: oracle-oval

Платформа: Oracle Linux 9

Описание

ELSA-2025-1681: bind security update (IMPORTANT)

[32:9.16.23-24.0.1.el9_5.3]

Fix bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

Обновленные пакеты

Oracle Linux 9

Oracle Linux aarch64

bind-devel

9.16.23-24.0.1.el9_5.3

bind-doc

9.16.23-24.0.1.el9_5.3

bind

9.16.23-24.0.1.el9_5.3

bind-chroot

9.16.23-24.0.1.el9_5.3

bind-dnssec-doc

9.16.23-24.0.1.el9_5.3

bind-dnssec-utils

9.16.23-24.0.1.el9_5.3

bind-libs

9.16.23-24.0.1.el9_5.3

bind-license

9.16.23-24.0.1.el9_5.3

bind-utils

9.16.23-24.0.1.el9_5.3

python3-bind

9.16.23-24.0.1.el9_5.3

Oracle Linux x86_64

bind

9.16.23-24.0.1.el9_5.3

bind-chroot

9.16.23-24.0.1.el9_5.3

bind-dnssec-doc

9.16.23-24.0.1.el9_5.3

bind-dnssec-utils

9.16.23-24.0.1.el9_5.3

bind-license

9.16.23-24.0.1.el9_5.3

bind-utils

9.16.23-24.0.1.el9_5.3

python3-bind

9.16.23-24.0.1.el9_5.3

bind-devel

9.16.23-24.0.1.el9_5.3

bind-doc

9.16.23-24.0.1.el9_5.3

bind-libs

9.16.23-24.0.1.el9_5.3

Связанные CVE

CVE-2024-11187

Ссылки на источники

Связанные уязвимости

CVE-2024-11187

CVSS3: 7.5

ubuntu

5 месяцев назад

It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.