"BIND Vulnerabilities Expose DNS Servers to Remote Attacks"

The Internet Systems Consortium (ISC) released updates for the BIND DNS software, patching vulnerabilities that could allow threat actors to perform denial-of-service (DoS) attacks and remote code execution. One of the flaws earned a CVSS score of 8.1. It is a buffer overflow that can lead to a server crash and remote code execution. According to ISC, only servers using a specific feature with non-default configurations are vulnerable to attacks. However, ISC suggested that these types of servers may be common. The US Cybersecurity and Infrastructure Security Agency (CISA) warned organizations about this vulnerability and urged them to apply the necessary updates or workarounds. Another recently disclosed high-severity vulnerability can be exploited remotely to cause the BIND name server (named) process to terminate because of a failed assertion check. The exploitation of this vulnerability could result in a DoS condition. This article continues to discuss the BIND flaws that leave DNS servers vulnerable to remote attacks. 

Security Week reports "BIND Vulnerabilities Expose DNS Servers to Remote Attacks"