"BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws"

The Internet Systems Consortium (ISC) recently announced patches for multiple high-severity denial-of-service (DoS) vulnerabilities in the DNS software suite BIND.  The addressed issues could be exploited remotely to cause named (the BIND daemon that acts both as an authoritative name server and as a recursive resolver) to crash or could lead to the exhaustion of the available memory.  The researchers noted that the first of the security defects tracked as CVE-2022-3094 can be exploited by sending a flood of dynamic DNS updates, which would cause named to allocate large amounts of memory, resulting in a crash due to a lack of free memory.  According to ISC, because allocated memory is only retained for clients for which access credentials are accepted, the scope of the vulnerability is limited to trusted clients that are allowed to make dynamic zone changes.  The researchers stated that for BIND 9.11 and earlier branches, the flaw can be exploited to exhaust internal resources, which results in performance issues but not a crash.  The ISC stated that the second issue, tracked as CVE-2022-3736, leads to a crash "when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to a positive integer, and when the resolver receives an RRSIG query." A remote attacker can trigger the bug by sending crafted queries to the resolver.  The third vulnerability, CVE-2022-3924, impacts the implementation of the stale-answer-client-timeout option when the resolver receives too many queries that require recursion.  The researchers noted that if the number of clients waiting for recursion to complete is high enough, a race may occur between providing a stale answer to the longest waiting client and sending an early timeout SERVFAIL, causing named to crash.  All three vulnerabilities were resolved with the release of BIND versions 9.16.37, 9.18.11, and 9.19.9.  The ISC says it is unaware of any of these vulnerabilities being exploited but encourages all users to update their BIND installations as soon as possible.

SecurityWeek reports: "BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws"