CVE-2023-5679: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution
First published: Mon Feb 12 2024(Updated: )
A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
Credit: security-officer@isc.org security-officer@isc.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/bind | <9.16.48 | 9.16.48 |
| redhat/bind | <9.18.24 | 9.18.24 |
| redhat/bind | <9.19.21 | 9.19.21 |
| debian/bind9 | 1:9.16.50-1~deb11u2 1:9.16.50-1~deb11u3 1:9.18.28-1~deb12u2 1:9.18.33-1~deb12u2 1:9.20.4-4 1:9.20.5-1 | |
| NetApp Active IQ Unified Manager for VMware vSphere | ||
| Fedora | =38 | |
| Fedora | =39 | |
| ISC BIND 9 | >=9.16.12<=9.16.45 | |
| ISC BIND 9 | >=9.18.0<=9.18.21 | |
| ISC BIND 9 | >=9.19.0<=9.19.19 | |
| ISC BIND 9 | =9.16.12-s1 | |
| ISC BIND 9 | =9.16.13-s1 | |
| ISC BIND 9 | =9.16.14-s1 | |
| ISC BIND 9 | =9.16.21-s1 | |
| ISC BIND 9 | =9.16.32-s1 | |
| ISC BIND 9 | =9.16.36-s1 | |
| ISC BIND 9 | =9.16.43-s1 | |
| ISC BIND 9 | =9.16.45-s1 | |
| ISC BIND 9 | =9.18.11-s1 | |
| ISC BIND 9 | =9.18.18-s1 | |
| ISC BIND 9 | =9.18.21-s1 |
Remedy
Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.48, 9.18.24, 9.19.21, 9.16.48-S1, or 9.18.24-S1.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2024/02/13/1
- https://kb.isc.org/docs/cve-2023-5679
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
- https://security.netapp.com/advisory/ntap-20240426-0002/
- https://launchpad.net/bugs/cve/CVE-2023-5679
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264064
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264361
- https://access.redhat.com/errata/RHSA-2024:1647
- https://access.redhat.com/errata/RHSA-2024:1648
- https://access.redhat.com/errata/RHSA-2024:1781
- https://access.redhat.com/errata/RHSA-2024:1789
- https://access.redhat.com/errata/RHSA-2024:1800
- https://access.redhat.com/errata/RHSA-2024:1803
- https://access.redhat.com/errata/RHSA-2024:2551
- https://bugzilla.redhat.com/show_bug.cgi?id=2263909
- https://security-tracker.debian.org/tracker/CVE-2023-5679
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5679
- https://nvd.nist.gov/vuln/detail/CVE-2023-5679
- https://ubuntu.com/security/CVE-2023-5679
Frequently Asked Questions
What is the severity of CVE-2023-5679?
CVE-2023-5679 is considered a medium severity vulnerability due to its potential to cause crashes in affected systems.
How do I fix CVE-2023-5679?
To fix CVE-2023-5679, update BIND to versions 9.16.48, 9.18.24, or 9.19.21 to resolve the issue.
What systems are affected by CVE-2023-5679?
CVE-2023-5679 affects BIND versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, and 9.19.0 through 9.19.19.
What are the symptoms of CVE-2023-5679?
Symptoms of CVE-2023-5679 include assertion failures and crashes of the 'named' service when recursive resolution is in use.
Is there a workaround for CVE-2023-5679?
Disabling either DNS64 or serve-stale features may serve as a temporary workaround for CVE-2023-5679 until a patch is applied.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2023-4408
- alias/CVE-2023-5517
- alias/CVE-2023-5679
- alias/CVE-2023-6516
- alias/CVE-2023-50387
- alias/CVE-2023-50868
- agent/title
- agent/type
- agent/author
- agent/severity
- agent/first-publish-date
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/source
- collector/security-tracker-debian
- source/Debian
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/redhat
- package-manager/debian
- vendor/netapp
- canonical/netapp active iq unified manager for vmware vsphere
- vendor/fedoraproject
- canonical/fedora
- version/fedora/38
- version/fedora/39
- vendor/isc
- canonical/isc bind 9
- version/isc bind 9/9.16.12
- version/isc bind 9/9.16.45
- version/isc bind 9/9.18.0
- version/isc bind 9/9.18.21
- version/isc bind 9/9.19.0
- version/isc bind 9/9.19.19
- version/isc bind 9/9.16.12-s1
- version/isc bind 9/9.16.13-s1
- version/isc bind 9/9.16.14-s1
- version/isc bind 9/9.16.21-s1
- version/isc bind 9/9.16.32-s1
- version/isc bind 9/9.16.36-s1
- version/isc bind 9/9.16.43-s1
- version/isc bind 9/9.16.45-s1
- version/isc bind 9/9.18.11-s1
- version/isc bind 9/9.18.18-s1
- version/isc bind 9/9.18.21-s1