CVE-2023-3341: A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

Published Sep 19, 2023
·
Updated

A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

Other sources

ISC BIND is vulnerable to a denial of service, caused by a stack exhaustion flaw in control channel code. By sending a specially crafted message over the control channel, a remote attacker could exploit this vulnerability to cause named to terminate.

— IBM

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

— Ubuntu

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly.

— Red Hat

Affected Software

55 affected componentsFixes available
debian/bind9<=1:9.18.16-1, <=1:9.18.16-1~deb12u1, <=1:9.16.42-1~deb11u1, <=1:9.16.37-1~deb11u1
1:9.19.17-11:9.18.19-1~deb12u11:9.16.44-1~deb11u1
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u7
1:9.11.5.P4+dfsg-5.1+deb10u101:9.16.44-1~deb11u11:9.16.48-11:9.18.19-1~deb12u11:9.18.24-11:9.19.21-1
ubuntu/bind9<1:9.11.3+dfsg-1ubuntu1.19+
1:9.11.3+dfsg-1ubuntu1.19+
ubuntu/bind9<1:9.16.1-0ubuntu2.16
1:9.16.1-0ubuntu2.16
ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.3
1:9.18.12-0ubuntu0.22.04.3
ubuntu/bind9<1:9.18.12-1ubuntu1.2
1:9.18.12-1ubuntu1.2
ubuntu/bind9<1:9.18.18-0ubuntu2
1:9.18.18-0ubuntu2
ubuntu/bind9<1:9.18.18-0ubuntu2
1:9.18.18-0ubuntu2
ubuntu/bind9<1:9.9.5.dfsg-3ubuntu0.19+
1:9.9.5.dfsg-3ubuntu0.19+
ubuntu/bind9<9.16.44, <9.18.19, <9.19.17
9.16.449.18.199.19.17
ubuntu/bind9<1:9.10.3.dfsg.
1:9.10.3.dfsg.
redhat/bind<9.16.44
9.16.44
redhat/bind<9.18.19
9.18.19
redhat/bind<9.19.17
9.19.17
ISC BIND>=9.2.0<9.16.44
ISC BIND>=9.18.0<9.18.19
ISC BIND>=9.19.0<9.19.17
ISC BIND=9.9.3-s1
ISC BIND=9.9.12-s1
ISC BIND=9.9.13-s1
ISC BIND=9.10.5-s1
ISC BIND=9.10.7-s1
ISC BIND=9.11.3-s1
ISC BIND=9.11.3-s4
ISC BIND=9.11.4-s1
ISC BIND=9.11.5-s3
ISC BIND=9.11.5-s5
ISC BIND=9.11.5-s6
ISC BIND=9.11.6-s1
ISC BIND=9.11.7-s1
ISC BIND=9.11.8-s1
ISC BIND=9.11.12-s1
ISC BIND=9.11.21-s1
ISC BIND=9.11.27-s1
ISC BIND=9.11.29-s1
ISC BIND=9.11.35-s1
ISC BIND=9.11.37-s1
ISC BIND=9.16.8-s1
ISC BIND=9.16.11-s1
ISC BIND=9.16.12-s1
ISC BIND=9.16.13-s1
ISC BIND=9.16.14-s1
ISC BIND=9.16.21-s1
ISC BIND=9.16.32-s1
ISC BIND=9.16.36-s1
ISC BIND=9.16.43-s1
ISC BIND=9.18.0-s1
ISC BIND=9.18.18-s1
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Debian Debian Linux=10.0
Debian Debian Linux=11.0
IBM QRadar Network Packet Capture<=7.5.0 - 7.5.0 Update Package 7
Microsoft cbl2 bind 9.16.44-1
Patch available
Microsoft azl3 bind 9.16.44-1
Patch available

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.19.17-1Fixed in 1:9.18.19-1~deb12u1Fixed in 1:9.16.44-1~deb11u1
  2. Upgrade

    Upgrade debian/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.11.5.P4+dfsg-5.1+deb10u10Fixed in 1:9.16.44-1~deb11u1Fixed in 1:9.16.48-1Fixed in 1:9.18.19-1~deb12u1Fixed in 1:9.18.24-1Fixed in 1:9.19.21-1
  3. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.11.3+dfsg-1ubuntu1.19+
  4. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.16.1-0ubuntu2.16
  5. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.18.12-0ubuntu0.22.04.3
  6. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.18.12-1ubuntu1.2
  7. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.18.18-0ubuntu2
  8. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.9.5.dfsg-3ubuntu0.19+
  9. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 9.16.44Fixed in 9.18.19Fixed in 9.19.17
  10. Upgrade

    Upgrade ubuntu/bind9 to a version that resolves this vulnerability.

    Fixed in 1:9.10.3.dfsg.
  11. Upgrade

    Upgrade redhat/bind to a version that resolves this vulnerability.

    Fixed in 9.16.44
  12. Upgrade

    Upgrade redhat/bind to a version that resolves this vulnerability.

    Fixed in 9.18.19
  13. Upgrade

    Upgrade redhat/bind to a version that resolves this vulnerability.

    Fixed in 9.19.17
  14. Upgrade

    Upgrade ISC BIND 9 to a version that resolves this vulnerability.

    Fixed in 9.16.44
  15. Upgrade

    Upgrade ISC BIND 9 to a version that resolves this vulnerability.

    Fixed in 9.18.19
  16. Upgrade

    Upgrade ISC BIND 9 to a version that resolves this vulnerability.

    Fixed in 9.19.17
  17. Upgrade

    Upgrade ISC BIND 9 to a version that resolves this vulnerability.

    Fixed in 9.16.44-S1
  18. Upgrade

    Upgrade ISC BIND 9 to a version that resolves this vulnerability.

    Fixed in 9.18.19-S1

Event History

Sep 20, 2023
CVE Published
via Ubuntu·12:00 AM
CVE Published
via MITRE·12:32 PM
Data Sourced
via MITRE·12:32 PM
RemedyDescriptionSeverity
Data Sourced
via NVD·01:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 17, 2024
Data Sourced
via Launchpad·12:43 AM
Description
Jun 30, 2024
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Jul 23, 2024
Data Sourced
via IBM·12:00 AM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2023-3341?

The severity of CVE-2023-3341 is high with a severity value of 7.5.

2

How does CVE-2023-3341 affect ISC BIND?

CVE-2023-3341 affects ISC BIND versions 9.2.0 to 9.16.44 and 9.18.0 to 9.18.19, as well as versions 9.19.0 to 9.19.17.

3

How can I fix CVE-2023-3341 on Ubuntu?

To fix CVE-2023-3341 on Ubuntu, update to bind9 version 1:9.16.1-0ubuntu2.16 or 1:9.18.12-0ubuntu0.22.04.3 depending on your distribution.

4

How can I fix CVE-2023-3341 on Debian?

To fix CVE-2023-3341 on Debian, update to bind9 version 1:9.18.16-1~deb12u1 or 1:9.16.42-1~deb11u1 depending on your distribution.

5

Where can I find more information about CVE-2023-3341?

You can find more information about CVE-2023-3341 on the MITRE CVE database and the ISC Knowledge Base.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203