CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled
First published: Mon Feb 12 2024(Updated: )
A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
Credit: security-officer@isc.org security-officer@isc.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/bind | <9.16.48 | 9.16.48 |
| redhat/bind | <9.18.24 | 9.18.24 |
| redhat/bind | <9.19.21 | 9.19.21 |
| debian/bind9 | 1:9.16.50-1~deb11u2 1:9.16.50-1~deb11u3 1:9.18.28-1~deb12u2 1:9.18.33-1~deb12u2 1:9.20.4-4 1:9.20.5-1 | |
| NetApp Active IQ Unified Manager for VMware vSphere | ||
| Fedora | =38 | |
| Fedora | =39 | |
| ISC BIND 9 | >=9.12.0<=9.16.45 | |
| ISC BIND 9 | >=9.18.0<=9.18.21 | |
| ISC BIND 9 | >=9.19.0<=9.19.19 | |
| ISC BIND 9 | =9.16.8-s1 | |
| ISC BIND 9 | =9.16.11-s1 | |
| ISC BIND 9 | =9.16.12-s1 | |
| ISC BIND 9 | =9.16.13-s1 | |
| ISC BIND 9 | =9.16.14-s1 | |
| ISC BIND 9 | =9.16.21-s1 | |
| ISC BIND 9 | =9.16.32-s1 | |
| ISC BIND 9 | =9.16.36-s1 | |
| ISC BIND 9 | =9.16.43-s1 | |
| ISC BIND 9 | =9.16.45-s1 | |
| ISC BIND 9 | =9.18.11-s1 | |
| ISC BIND 9 | =9.18.18-s1 | |
| ISC BIND 9 | =9.18.21-s1 |
Remedy
Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.48, 9.18.24, 9.19.21, 9.16.48-S1, or 9.18.24-S1.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://kb.isc.org/docs/cve-2023-5517
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- http://www.openwall.com/lists/oss-security/2024/02/13/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
- https://security.netapp.com/advisory/ntap-20240503-0006/
- https://launchpad.net/bugs/cve/CVE-2023-5517
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264063
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264360
- https://access.redhat.com/errata/RHSA-2024:1647
- https://access.redhat.com/errata/RHSA-2024:1648
- https://access.redhat.com/errata/RHSA-2024:1781
- https://access.redhat.com/errata/RHSA-2024:1789
- https://access.redhat.com/errata/RHSA-2024:1800
- https://access.redhat.com/errata/RHSA-2024:1803
- https://access.redhat.com/errata/RHSA-2024:2551
- https://bugzilla.redhat.com/show_bug.cgi?id=2263897
- https://security-tracker.debian.org/tracker/CVE-2023-5517
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5517
- https://nvd.nist.gov/vuln/detail/CVE-2023-5517
- https://ubuntu.com/security/CVE-2023-5517
Frequently Asked Questions
What is the severity of CVE-2023-5517?
CVE-2023-5517 has a high severity rating due to the potential for causing named to exit prematurely.
How do I fix CVE-2023-5517?
To fix CVE-2023-5517, upgrade to bind version 9.16.48, 9.18.24, or 9.19.21 or later.
What systems are affected by CVE-2023-5517?
CVE-2023-5517 affects various versions of ISC BIND, Red Hat bind, and Debian bind9 installations.
What scenarios trigger CVE-2023-5517?
CVE-2023-5517 is triggered when nxdomain-redirect is configured alongside a PTR query for an RFC 1918 address.
How can I identify if my system is vulnerable to CVE-2023-5517?
You can identify vulnerability to CVE-2023-5517 by checking if you are running an affected version of bind.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2023-4408
- alias/CVE-2023-5517
- alias/CVE-2023-5679
- alias/CVE-2023-6516
- alias/CVE-2023-50387
- alias/CVE-2023-50868
- agent/title
- agent/type
- agent/author
- agent/remedy
- agent/severity
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/source
- collector/security-tracker-debian
- source/Debian
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/redhat
- package-manager/debian
- vendor/netapp
- canonical/netapp active iq unified manager for vmware vsphere
- vendor/fedoraproject
- canonical/fedora
- version/fedora/38
- version/fedora/39
- vendor/isc
- canonical/isc bind 9
- version/isc bind 9/9.12.0
- version/isc bind 9/9.16.45
- version/isc bind 9/9.18.0
- version/isc bind 9/9.18.21
- version/isc bind 9/9.19.0
- version/isc bind 9/9.19.19
- version/isc bind 9/9.16.8-s1
- version/isc bind 9/9.16.11-s1
- version/isc bind 9/9.16.12-s1
- version/isc bind 9/9.16.13-s1
- version/isc bind 9/9.16.14-s1
- version/isc bind 9/9.16.21-s1
- version/isc bind 9/9.16.32-s1
- version/isc bind 9/9.16.36-s1
- version/isc bind 9/9.16.43-s1
- version/isc bind 9/9.16.45-s1
- version/isc bind 9/9.18.11-s1
- version/isc bind 9/9.18.18-s1
- version/isc bind 9/9.18.21-s1