CVE-2023-5679

Отчет

The identified vulnerability in the BIND DNS server poses a important severity risk due to its potential to induce a Denial of Service (DoS) through a targeted exploitation of DNS64 functionality. Specifically, the flaw allows an attacker to send a crafted domain query that triggers a code assertion failure within the named process. This leads to a crash of the DNS server, disrupting its ability to resolve queries and maintain network operations. As a result, the DNS service becomes unavailable to legitimate users, impacting the integrity and availability of network services and potentially disrupting business operations or network communications. The exploitation of this vulnerability by an unauthenticated remote user underscores the urgent need for immediate patching and mitigation to safeguard DNS infrastructure against service outages.

Меры по смягчению последствий

This vulnerability can be mitigated by either disabled server-stale configuration, using both of the switches bellow in named configuration file:

1. set stale-cache-enable no;
2. set stale-answer-enable no; Alternatively, disable the DNS64 option. Both mitigations should make the affected code unreachable, making it impossible to an attacker to exploit this vulnerability.