This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] BIND fixes 2 highly severe vulnerabilities
BIND 9 versions 9.21.4, 9.20.5, 9.18.33 and 9.18.33-S1 fix 2 highly severe vulnerabilities [1][2]. Debian released a fix for the bookworm distribution in version 1:9.18.33-1~deb12u2 and for sid in version 1:9.20.5-1 [3][4]. Ubuntu fixed it in versions 1:9.20.0-2ubuntu3.1 (24.10 oracular), 1:9.18.30-0ubuntu0.24.04.2 (24.04 LTS noble), 1:9.18.30-0ubuntu0.22.04.2 (22.04 LTS jammy) and 1:9.18.30-0ubuntu0.20.04.2 (20.04 LTS focal) [5][6]. Slackware released a fix as part of SSA:2025-029-01 here [7].
Allows an unauthenticated remote attacker to create a specially crafted DNS zone whose queries generate responses containing a large number of records in the Additional section, which leads to excessive load on an authoritative server or an independent resolver and may cause performance degradation or complete unavailability of the service. To exploit the vulnerability, the zones must be created deliberately [1].
The vulnerability is present in products:
- *:BIND; >=9.21.0, <=9.21.3; >=9.20.0, <=9.20.4; >=9.18.0, <=9.18.32; >=9.16.0, <=9.16.50; >=9.11.0, <=9.11.37
- *:BIND Supported Preview Edition; >=9.18.11-S1, <=9.18.32-S1; >=9.16.8-S1, <=9.16.50-S1; >=9.11.3-S1, <=9.11.37-S1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-11187 at cve.org, NVD
- CWE-405: Asymmetric Resource Consumption (Amplification) at cwe.mitre.org
The vulnerability was publicly disclosed 29. 1. 2025.
Allows an unauthenticated remote attacker using the DNS-over-HTTPS protocol to exhaust the CPU and/or memory of the DNS resolver by flooding it with valid or invalid HTTP/2 traffic, which may slow it down or make it completely unavailable to legitimate users [2].
The vulnerability is present in products:
- *:BIND; >=9.21.0, <=9.21.3; >=9.20.0, <=9.20.4; >=9.18.0, <=9.18.32
- *:BIND Supported Preview Edition; >=9.18.11-S1, <=9.18.32-S1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-12705 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 29. 1. 2025.
Links
- [1] https://kb.isc.org/docs/cve-2024-11187
- [2] https://kb.isc.org/docs/cve-2024-12705
- [3] https://security-tracker.debian.org/tracker/CVE-2024-11187
- [4] https://security-tracker.debian.org/tracker/CVE-2024-12705
- [5] https://ubuntu.com/security/CVE-2024-11187
- [6] https://ubuntu.com/security/CVE-2024-12705
- [7] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.353626
By CESNET, z.s.p.o. Michaela Jarošová on 31. 1. 2025.