ArchLinux: 202110-12: bind: denial of service

Advisories

Arch Linux Security Advisory ASA-202110-12
==========================================

Severity: Medium
Date    : 2021-10-29
CVE-ID  : CVE-2021-25219
Package : bind
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2502

Summary
=======

The package bind before version 9.16.22-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 9.16.22-1.

# pacman -Syu "bind>=9.16.22-1"

The problem has been fixed upstream in version 9.16.22.

Workaround
==========

Setting "lame-ttl 0;" in the BIND configuration prevents the
performance issue.

Description
===========

In BIND before version 9.16.22, exploitation of broken authoritative
servers using a flaw in response processing can cause degradation in
BIND resolver performance. The way the lame cache is currently designed
makes it possible for its internal data structures to grow almost
infinitely, which may cause significant delays in client query
processing.

Impact
======

A malicious DNS client could trigger queries to broken authoritative
DNS servers, resulting in high CPU usage and service degradation of the
BIND server.

References
==========

https://kb.isc.org/v1/docs/cve-2021-25219
https://github.com/isc-projects/bind9/commit/8fe18c0566c41228a568157287f5a44f96d37662
https://security.archlinux.org/CVE-2021-25219

ArchLinux: 202110-12: bind: denial of service

November 1, 2021
The package bind before version 9.16.22-1 is vulnerable to denial of service

Summary

In BIND before version 9.16.22, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Resolution

Upgrade to 9.16.22-1.
# pacman -Syu "bind>=9.16.22-1"
The problem has been fixed upstream in version 9.16.22.

References

https://kb.isc.org/v1/docs/cve-2021-25219 https://github.com/isc-projects/bind9/commit/8fe18c0566c41228a568157287f5a44f96d37662 https://security.archlinux.org/CVE-2021-25219

Severity
CVE-ID : CVE-2021-25219
Package : bind
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-2502

Impact

A malicious DNS client could trigger queries to broken authoritative DNS servers, resulting in high CPU usage and service degradation of the BIND server.

Workaround

Setting "lame-ttl 0;" in the BIND configuration prevents theperformance issue.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.