SUSE-SU-2023:3737-1: Security update for bind

Q: What must an attacker be able to reach to trigger this issue?

The flaw is in BIND's control channel code. An attacker would need access to the named control channel; the advisory does not state whether authentication or other control-channel restrictions are required.

Q: What is the likely impact if the issue is exploited?

The stack exhaustion flaw may cause named to terminate unexpectedly. This indicates a denial-of-service impact on the DNS service.

Q: Which systems and packages should be reviewed for this update?

Review affected SUSE Server Applications Module 15-SP4 systems on aarch64, ppc64le, s390x, and x86_64 that use BIND packages. The update includes bind and related bind utilities, documentation, Python bindings, and debug packages.

Q: What release contains the fix?

The advisory states that the update moves BIND to release 9.16.44 and fixes CVE-2023-3341.

Published Sep 22, 2023

Updated

This update for bind fixes the following issues: Update to release 9.16.44: CVE-2023-3341: Fixed stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (bsc#1215472).

Affected Software

22 affected componentsFixes available

All of the following

SUSE Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/bind-debugsource<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-debuginfo<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

All of the following

SUSE Server Applications Module 15-SP4 (noarch)

suse/bind-doc<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

All of the following

SUSE openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/bind-utils<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-debugsource<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-debuginfo<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-utils-debuginfo<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

All of the following

SUSE openSUSE Leap 15.4 (noarch)

Any of the following

suse/python3-bind<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-doc<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

All of the following

SUSE Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/bind-debugsource<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-utils-debuginfo<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-debuginfo<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

suse/bind-utils<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

All of the following

SUSE Basesystem Module 15-SP4 (noarch)

suse/python3-bind<9.16.44-150400.5.37.2

9.16.44-150400.5.37.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/bind-debugsource to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade suse/bind to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade suse/bind-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade suse/bind-doc to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade suse/bind-utils to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade suse/bind-utils-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade suse/python3-bind to a version that resolves this vulnerability.
Fixed in 9.16.44-150400.5.37.2
Upgrade
Upgrade bind to a version that resolves this vulnerability.
Fixed in 9.16.44Patch SUSE-2023-3737

Event History

Sep 22, 2023

Advisory Published

08:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-3341

Frequently Asked Questions

What must an attacker be able to reach to trigger this issue?

The flaw is in BIND's control channel code. An attacker would need access to the named control channel; the advisory does not state whether authentication or other control-channel restrictions are required.

What is the likely impact if the issue is exploited?

The stack exhaustion flaw may cause named to terminate unexpectedly. This indicates a denial-of-service impact on the DNS service.

Which systems and packages should be reviewed for this update?

Review affected SUSE Server Applications Module 15-SP4 systems on aarch64, ppc64le, s390x, and x86_64 that use BIND packages. The update includes bind and related bind utilities, documentation, Python bindings, and debug packages.

What release contains the fix?

The advisory states that the update moves BIND to release 9.16.44 and fixes CVE-2023-3341.

SUSE-SU-2023:3737-1: Security update for bind

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker be able to reach to trigger this issue?

What is the likely impact if the issue is exploited?

Which systems and packages should be reviewed for this update?

What release contains the fix?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to reach to trigger this issue?

What is the likely impact if the issue is exploited?

Which systems and packages should be reviewed for this update?

What release contains the fix?