CVE-2023-4408: Parsing large DNS messages may cause excessive CPU load
First published: Mon Feb 12 2024(Updated: )
Last updated 24 July 2024
Credit: security-officer@isc.org security-officer@isc.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netapp Ontap | =9.14.1 | |
| Netapp Ontap | =9.15.1 | |
| Fedoraproject Fedora | =38 | |
| Fedoraproject Fedora | =39 | |
| ISC BIND | >=9.0.0<=9.16.45 | |
| ISC BIND | >=9.18.0<=9.18.21 | |
| ISC BIND | >=9.19.0<=9.19.19 | |
| ISC BIND | =9.9.3-s1 | |
| ISC BIND | =9.16.8-s1 | |
| ISC BIND | =9.16.11-s1 | |
| ISC BIND | =9.16.12-s1 | |
| ISC BIND | =9.16.13-s1 | |
| ISC BIND | =9.16.14-s1 | |
| ISC BIND | =9.16.21-s1 | |
| ISC BIND | =9.16.32-s1 | |
| ISC BIND | =9.16.36-s1 | |
| ISC BIND | =9.16.43-s1 | |
| ISC BIND | =9.18.0-s1 | |
| ISC BIND | =9.18.11-s1 | |
| ISC BIND | =9.18.18-s1 | |
| redhat/bind | <9.16.48 | 9.16.48 |
| redhat/bind | <9.18.24 | 9.18.24 |
| redhat/bind | <9.19.21 | 9.19.21 |
| F5 BIG-IP | >=17.1.0<=17.1.1 | 17.1.2 |
| F5 BIG-IP | >=16.1.0<=16.1.4 | 16.1.5 |
| F5 BIG-IP | >=15.1.0<=15.1.10 | |
| F5 BIG-IQ Centralized Management | >=8.1.0<=8.3.0 | |
| debian/bind9 | 1:9.16.50-1~deb11u2 1:9.16.50-1~deb11u1 1:9.18.28-1~deb12u2 1:9.20.4-2 |
Remedy
Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.48, 9.18.24, 9.19.21, 9.16.48-S1, or 9.18.24-S1.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2024/02/13/1
- https://kb.isc.org/docs/cve-2023-4408
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
- https://security.netapp.com/advisory/ntap-20240426-0001/
- https://launchpad.net/bugs/cve/CVE-2023-4408
- https://my.f5.com/manage/s/article/K000138990
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264062
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264365
- https://access.redhat.com/errata/RHSA-2024:1647
- https://access.redhat.com/errata/RHSA-2024:1648
- https://access.redhat.com/errata/RHSA-2024:1781
- https://access.redhat.com/errata/RHSA-2024:1782
- https://access.redhat.com/errata/RHSA-2024:1789
- https://access.redhat.com/errata/RHSA-2024:1800
- https://access.redhat.com/errata/RHSA-2024:1803
- https://access.redhat.com/errata/RHSA-2024:2551
- https://access.redhat.com/errata/RHSA-2024:2720
- https://access.redhat.com/errata/RHSA-2024:2721
- https://access.redhat.com/errata/RHSA-2024:2821
- https://access.redhat.com/errata/RHSA-2024:2890
- https://access.redhat.com/errata/RHSA-2024:3271
- https://access.redhat.com/errata/RHSA-2024:3741
- https://bugzilla.redhat.com/show_bug.cgi?id=2263896
- https://gitlab.isc.org/isc-projects/bind9/-/commit/770bb71ce7d934d2461a719af76bee3803145811
- https://gitlab.isc.org/isc-projects/bind9/-/commit/0bbb0065e63c3231b320bd20d1121aed6c4d00d8
- https://gitlab.isc.org/isc-projects/bind9/-/commit/f397ff5bb81413004fa6367f63a833fe70a3ac59
- https://security-tracker.debian.org/tracker/CVE-2023-4408
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4408
- https://nvd.nist.gov/vuln/detail/CVE-2023-4408
- https://ubuntu.com/security/CVE-2023-4408
- collector/oss-sec
- source/oss-sec
- alias/CVE-2023-4408
- alias/CVE-2023-5517
- alias/CVE-2023-5679
- alias/CVE-2023-6516
- alias/CVE-2023-50387
- alias/CVE-2023-50868
- agent/title
- agent/type
- agent/author
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- collector/f5-advisory
- source/F5
- agent/last-modified-date
- collector/nvd-cve
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/netapp
- canonical/netapp ontap
- version/netapp ontap/9.14.1
- version/netapp ontap/9.15.1
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/38
- version/fedoraproject fedora/39
- vendor/isc
- canonical/isc bind
- version/isc bind/9.0.0
- version/isc bind/9.16.45
- version/isc bind/9.18.0
- version/isc bind/9.18.21
- version/isc bind/9.19.0
- version/isc bind/9.19.19
- version/isc bind/9.9.3-s1
- version/isc bind/9.16.8-s1
- version/isc bind/9.16.11-s1
- version/isc bind/9.16.12-s1
- version/isc bind/9.16.13-s1
- version/isc bind/9.16.14-s1
- version/isc bind/9.16.21-s1
- version/isc bind/9.16.32-s1
- version/isc bind/9.16.36-s1
- version/isc bind/9.16.43-s1
- version/isc bind/9.18.0-s1
- version/isc bind/9.18.11-s1
- version/isc bind/9.18.18-s1
- package-manager/redhat
- vendor/f5
- canonical/f5 big-ip
- version/f5 big-ip/17.1.0
- version/f5 big-ip/17.1.1
- version/f5 big-ip/16.1.0
- version/f5 big-ip/16.1.4
- version/f5 big-ip/15.1.0
- version/f5 big-ip/15.1.10
- canonical/f5 big-iq centralized management
- version/f5 big-iq centralized management/8.1.0
- version/f5 big-iq centralized management/8.3.0
- package-manager/debian