CVE-2023-4408 Information

Description

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45 9.18.0 through 9.18.21 9.19.0 through 9.19.19 9.9.3-S1 through 9.11.37-S1 9.16.8-S1 through 9.16.45-S1 and 9.18.11-S1 through 9.18.21-S1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

https://kb.isc.org/docs/cve-2023-4408 http://www.openwall.com/lists/oss-security/2024/02/13/1

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5