Latest Isc Vulnerabilities

Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilities
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2022
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2022, 23H2 Edition
Microsoft Windows Server 2022
and 58 more
named may terminate unexpectedly under high DNS-over-TLS query load
debian/bind9<=1:9.18.16-1~deb12u1<=1:9.18.16-1
ISC BIND>=9.18.0<9.18.18
ISC BIND=9.18.11-s1
ISC BIND=9.18.18-s1
debian/bind9
Fedoraproject Fedora=37
and 19 more
A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly
debian/bind9<=1:9.18.16-1<=1:9.18.16-1~deb12u1<=1:9.16.42-1~deb11u1<=1:9.16.37-1~deb11u1
ISC BIND>=9.2.0<9.16.44
ISC BIND>=9.18.0<9.18.19
ISC BIND>=9.19.0<9.19.17
ISC BIND=9.9.3-s1
ISC BIND=9.9.12-s1
and 47 more
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely termina...
ISC BIND>=9.16.8<=9.16.41
ISC BIND>=9.18.11<=9.18.15
Netapp Active Iq Unified Manager Vmware Vsphere
Netapp H500s Firmware
Netapp H500s
Netapp H700s Firmware
and 7 more
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could c...
ubuntu/bind9<1:9.16.1-0ubuntu2.15
ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.2
ubuntu/bind9<1:9.18.12-0ubuntu0.22.10.2
ubuntu/bind9<1:9.18.12-1ubuntu1.1
ubuntu/bind9<9.16.42<9.18.16
ubuntu/bind9<1:9.18.12-1ubuntu2
and 30 more
ISC BIND is vulnerable to a denial of service, caused by a flaw that allows the named's configured cache size limit to be significantly exceeded. By querying the resolver for specific RRsets in a cert...
IBM QRadar SIEM<=7.5.0 - 7.5.0 UP6
ubuntu/bind9<1:9.11.3+dfsg-1ubuntu1.19+
ubuntu/bind9<1:9.9.5.dfsg-3ubuntu0.19+
ubuntu/bind9<1:9.10.3.dfsg.
ubuntu/bind9<1:9.16.1-0ubuntu2.15
ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.2
and 39 more
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broke...
ISC BIND=9.11.4-s1
ISC BIND=9.11.37-s1
ISC BIND=9.16.8-s1
ISC BIND=9.16.36-s1
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receiv...
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.16.23-11.el9
ISC BIND>=9.16.12<9.16.37
ISC BIND>=9.18.0<9.18.11
ISC BIND>=9.19.0<9.19.9
ISC BIND=9.16.12-s1
and 5 more
BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affect...
redhat/bind<9.16.37
redhat/bind<9.18.11
redhat/bind<9.19.9
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.16.23-11.el9
ISC BIND>=9.16.12<9.16.37
and 8 more
A flaw was found in Bind, where sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This issue may cause named to exit due to a lack of free memory, resulting i...
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.16.23-11.el9
ISC BIND>=9.16.0<9.16.37
ISC BIND>=9.18.0<9.18.11
ISC BIND>=9.19.0<9.19.9
ISC BIND=9.16.8-s1
and 6 more
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause ...
ISC DHCP>=1.0.0<4.1-esv
ISC DHCP>=4.2.0<=4.4.3
ISC DHCP=4.1-esv-r1
ISC DHCP=4.1-esv-r10
ISC DHCP=4.1-esv-r10_b1
ISC DHCP=4.1-esv-r10_rc1
and 29 more
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is ...
ISC DHCP>=4.4.0<=4.4.3
ISC DHCP=4.1-esv-r1
ISC DHCP=4.1-esv-r10
ISC DHCP=4.1-esv-r10_b1
ISC DHCP=4.1-esv-r10_rc1
ISC DHCP=4.1-esv-r10b1
and 28 more
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless the...
ISC BIND>=9.18.0<9.18.7
ISC BIND>=9.19.0<9.19.5
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where...
redhat/bind<32:9.11.4-26.P2.el7_9.10
redhat/bind<32:9.11.36-3.el8_6.1
redhat/bind9.16<32:9.16.23-0.7.el8_6.1
redhat/bind<32:9.11.4-26.P2.el8_1.6
redhat/bind<32:9.11.13-6.el8_2.4
redhat/bind<32:9.11.26-4.el8_4.1
and 35 more
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where...
redhat/bind<32:9.11.4-26.P2.el7_9.10
redhat/bind<32:9.11.36-3.el8_6.1
redhat/bind9.16<32:9.16.23-0.7.el8_6.1
redhat/bind<32:9.11.4-26.P2.el8_1.6
redhat/bind<32:9.11.13-6.el8_2.4
redhat/bind<32:9.11.26-4.el8_4.1
and 37 more
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution s...
redhat/bind<32:9.11.4-26.P2.el7_9.13
redhat/bind9.16<32:9.16.23-0.14.el8
redhat/bind<32:9.11.36-8.el8
redhat/bind<32:9.16.23-11.el9
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u7
redhat/bind<9.16.33
and 37 more
By sending specific queries to the resolver, an attacker can cause named to crash.
ISC BIND>=9.16.14<9.16.33
ISC BIND>=9.18.0<9.18.7
ISC BIND>=9.19.0<9.19.5
ISC BIND=9.16.14-s1
ISC BIND=9.16.21-s1
ISC BIND=9.16.32-s1
and 6 more
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-o...
ISC BIND>=9.18.0<=9.18.2
ISC BIND=9.19.0
Netapp H410c Firmware
Netapp H410c
Netapp H300s Firmware
Netapp H300s
and 6 more
Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.
ISC BIND=9.18.0
Netapp Baseboard Management Controller H300s Firmware
Netapp Baseboard Management Controller H300s
Netapp Baseboard Management Controller H500s Firmware
Netapp Baseboard Management Controller H500s
Netapp Baseboard Management Controller H700s Firmware
and 27 more
When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
ISC BIND=9.18.0
Netapp Baseboard Management Controller H300s Firmware
Netapp Baseboard Management Controller H300s
Netapp Baseboard Management Controller H500s Firmware
Netapp Baseboard Management Controller H500s
Netapp Baseboard Management Controller H700s Firmware
and 27 more
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE...
redhat/bind9.16<32:9.16.23-0.9.el8.1
redhat/bind<32:9.16.23-5.el9_1
ISC BIND>=9.16.11<9.16.27
ISC BIND>=9.16.11<9.16.27
ISC BIND>=9.17.0<=9.18.0
Fedoraproject Fedora=34
and 39 more
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, ...
redhat/bind<32:9.11.4-26.P2.el7_9.13
redhat/bind9.16<32:9.16.23-0.9.el8.1
redhat/bind<32:9.11.36-5.el8
redhat/bind<32:9.16.23-5.el9_1
redhat/dhcp<12:4.4.2-17.b1.el9
ISC BIND>=9.11.0<9.11.37
and 184 more
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIN...
debian/bind9
ISC BIND>=9.3.0<9.11.36
ISC BIND>=9.12.0<9.16.22
ISC BIND>=9.17.0<9.17.19
ISC BIND=9.9.3-s1
ISC BIND=9.9.12-s1
and 46 more
A flaw was found in the Dynamic Host Configuration Protocol (DHCP). There is a discrepancy between the code that handles encapsulated option information in leases transmitted "on the wire" and the cod...
redhat/dhcp<12:4.1.1-64.P1.el6_10
redhat/dhcp<12:4.2.5-83.el7_9.1
redhat/dhcp<12:4.2.5-42.el7_2.2
redhat/dhcp<12:4.2.5-47.el7_3.2
redhat/dhcp<12:4.2.5-58.el7_4.5
redhat/dhcp<12:4.2.5-69.el7_6.1
and 69 more
ISC BIND TKEY Query Integer Overflow Remote Code Execution Vulnerability
debian/bind9
ISC BIND
debian/bind9<=1:9.11.5.P4+dfsg-5.1<=1:9.11.5.P4+dfsg-5.1+deb10u3<=1:9.16.13-1
Debian Debian Linux=9.0
Debian Debian Linux=10.0
ISC BIND>=9.0.0<9.11.31
and 42 more
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of th...
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u3<=1:9.11.5.P4+dfsg-5.1<=1:9.16.13-1
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
debian/bind9
Debian Debian Linux=9.0
and 47 more
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17....
debian/bind9
debian/bind9<=1:9.11.5.P4+dfsg-5.1<=1:9.16.13-1<=1:9.11.5.P4+dfsg-5.1+deb10u3
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.8.5<=9.8.8
and 47 more
ISC BIND TKEY Query Heap-based Buffer Overflow Remote Code Execution Vulnerability
debian/bind9
debian/bind9<=1:9.11.5.P4+dfsg-5.1+deb10u2<=1:9.11.5.P4+dfsg-5.1<=1:9.16.11-2
ISC BIND
ISC BIND>=9.5.0<=9.11.27
ISC BIND>=9.12.0<=9.16.11
ISC BIND=9.11.3-s1
and 25 more
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing t...
ISC BIND>=9.15.6<=9.16.5
ISC BIND>=9.17.0<=9.17.3
ISC BIND=9.9.12-s1
ISC BIND=9.9.13-s1
ISC BIND=9.11.3-s1
ISC BIND=9.11.21-s1
and 8 more
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition ...
ISC BIND>=9.14.0<=9.16.5
ISC BIND>=9.17.0<=9.17.3
openSUSE Leap=15.1
openSUSE Leap=15.2
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
and 5 more
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a speci...
ISC BIND>=9.10.0<=9.11.21
ISC BIND>=9.12.1<=9.16.5
ISC BIND>=9.17.0<=9.17.3
ISC BIND=9.10.5-s1
ISC BIND=9.11.21-s1
Fedoraproject Fedora=31
and 14 more
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or...
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.0.0<=9.11.21
ISC BIND>=9.12.0<=9.16.5
ISC BIND>=9.17.0<=9.17.3
and 21 more
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition,...
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.9.12<=9.9.13
ISC BIND>=9.10.7<=9.10.8
ISC BIND>=9.11.3<=9.11.21
and 18 more
In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative se...
ISC BIND>=9.11.14<=9.11.19
ISC BIND>=9.11.14-s1<=9.11.19-s1
ISC BIND>=9.14.9<=9.14.12
ISC BIND>=9.16.0<=9.16.3
Fedoraproject Fedora=31
Fedoraproject Fedora=32
and 8 more
An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clien...
ISC BIND>=9.16.0<=9.16.3
openSUSE Leap=15.1
openSUSE Leap=15.2
Netapp Steelstore Cloud Integrated Storage
Canonical Ubuntu Linux=20.04
ubuntu/bind9<1:9.16.1-0ubuntu2.2
and 2 more
ISC BIND is vulnerable to a denial of service, caused by a logic error in code which checks TSIG validity. A remote attacker could exploit this vulnerability to trigger an assertion failure in tsig.c.
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
ISC BIND>=9.0.0<=9.11.18
ISC BIND>=9.12.0<=9.12.4
ISC BIND>=9.13.0<=9.13.7
and 34 more
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a...
ISC BIND>=9.0.0<=9.11.18
ISC BIND>=9.12.0<=9.12.4
ISC BIND>=9.13.0<=9.13.7
ISC BIND>=9.14.0<=9.14.11
ISC BIND>=9.15.0<=9.15.6
ISC BIND>=9.16.0<=9.16.2
and 20 more
ISC BIND is vulnerable to a denial of service. By sending TCP-pipelined queries, a remote attacker could exploit this vulnerability to bypass tcp-clients limit and cause the server to consume all avai...
debian/bind9<=1:9.15.5-1<=1:9.11.5.P4+dfsg-1<=1:9.11.5.P4+dfsg-5.1
IBM Data Risk Manager<=2.0.6
ISC BIND>=9.11.7<=9.11.12
ISC BIND>=9.14.1<=9.14.7
ISC BIND>=9.15.0<=9.15.5
ISC BIND=9.11.5-s6
and 11 more
Cache Poisoning issue exists in DNS Response Rate Limiting.
ISC BIND>=9.8.0<=9.9.0
Nlnetlabs Nsd=3.2.15
Nic Knot Resolver<1.3.0
Redhat Enterprise Linux=6.0
Redhat Enterprise Linux=7.0
While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No IS...
ISC BIND>=9.9.4-65<=9.9.4-72
Redhat Enterprise Linux=7.0
A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.1...
ISC BIND>=9.14.0<=9.14.6
ISC BIND>=9.15.0<=9.15.4
Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DN...
ISC BIND>=9.14.0<=9.14.6
ISC BIND>=9.15.0<=9.15.4
A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
ISC Kea>=1.4.0<=1.5.0
ISC Kea=1.6.0-beta1
ISC Kea=1.6.0-beta2
An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND ...
ISC BIND=9.10.5-s1
ISC BIND=9.11.6-s1
A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12...
F5 Big-ip Local Traffic Manager>=11.5.2<=11.5.9
F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.4
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.4
F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.1
F5 Big-ip Local Traffic Manager=14.0.0
F5 Big-ip Local Traffic Manager=14.1.0
and 103 more
ISC BIND=9.10.5-s1
ISC BIND=9.11.5-s5
A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. Th...
ISC BIND>=9.12.0<=9.12.4
ISC BIND>=9.13.0<=9.13.7
ISC BIND=9.14.0
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conserva...
F5 Big-ip Local Traffic Manager>=11.5.2<=11.6.5
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.4
F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.1
F5 Big-ip Local Traffic Manager>=14.0.0<=14.1.0
F5 Big-ip Local Traffic Manager=15.0.0
F5 Big-ip Application Acceleration Manager>=11.5.2<=11.6.5
and 73 more
A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, an...
ISC BIND>=9.10.7<9.10.8
ISC BIND>=9.11.3<9.11.5
ISC BIND>=9.12.0<9.12.3
ISC BIND>=9.13.0<9.13.6
ISC BIND=9.10.7-s1
ISC BIND=9.10.8
and 10 more
ISC BIND could allow a remote attacker to obtain sensitive information, caused by the failure to properly apply controls for zone transfers to Dynamically Loadable Zones (DLZs) if the zones are writab...
IBM Data Risk Manager<=2.0.6
redhat/bind<9.11.5
redhat/bind<9.12.3
ISC BIND>=9.9.0<=9.10.7
ISC BIND>=9.11.0<=9.11.4
ISC BIND>=9.12.0<=9.12.2
and 12 more

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203