A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-687525fcca advisory.

    # BIND 9.18.19

    ##Security Fixes

    -    Previously, sending a specially crafted message over the control channel could cause the packet-     parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been     fixed. ([CVE-2023-3341](https://access.redhat.com/security/cve/CVE-2023-3341))
    -    A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate     unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed.
    ([CVE-2023-4236](https://access.redhat.com/security/cve/CVE-2023-4236))
    - [Upstream release notes](https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-     bind-9-18-19)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-b4acb0f7c6 advisory.

    # BIND 9.18.19

    ##Security Fixes

    -    Previously, sending a specially crafted message over the control channel could cause the packet-     parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been     fixed. ([CVE-2023-3341](https://access.redhat.com/security/cve/CVE-2023-3341))
    -    A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate     unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed.
    ([CVE-2023-4236](https://access.redhat.com/security/cve/CVE-2023-4236))
    - [Upstream release notes](https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-     bind-9-18-19)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-87502c4a93 advisory.

    # BIND 9.18.19

    ##Security Fixes

    -    Previously, sending a specially crafted message over the control channel could cause the packet-     parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been     fixed. ([CVE-2023-3341](https://access.redhat.com/security/cve/CVE-2023-3341))
    -    A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate     unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed.
    ([CVE-2023-4236](https://access.redhat.com/security/cve/CVE-2023-4236))
    - [Upstream release notes](https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-     bind-9-18-19)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-a2621f58a9 advisory.

    # BIND 9.18.19

    ##Security Fixes

    -    Previously, sending a specially crafted message over the control channel could cause the packet-     parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been     fixed. ([CVE-2023-3341](https://access.redhat.com/security/cve/CVE-2023-3341))
    -    A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate     unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed.
    ([CVE-2023-4236](https://access.redhat.com/security/cve/CVE-2023-4236))
    - [Upstream release notes](https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-     bind-9-18-19)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5504 advisory.

  - The code that processes control channel messages sent to `named` calls certain functions recursively     during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on     the environment, this may cause the packet-parsing code to run out of available stack memory, causing     `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its     contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key;
    only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9     versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through     9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. (CVE-2023-3341)

  - A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly     due to an assertion failure. This happens when internal data structures are incorrectly reused under     significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and     9.18.11-S1 through 9.18.18-S1. (CVE-2023-4236)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6390-1 advisory.

    It was discovered that Bind incorrectly handled certain control channel messages. A remote attacker with     access to the control channel could possibly use this issue to cause Bind to crash, resulting in a denial     of service. (CVE-2023-3341)

    Robert Story discovered that Bind incorrectly handled certain DNS-over-TLS queries. A remote attacker     could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-4236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2023-4236 advisory.

  - A flaw in the networking code handling DNS-over-TLS queries may cause  named  to terminate unexpectedly     due to an assertion failure. This happens when internal data structures are incorrectly reused under     significant DNS-over-TLS query load.A  named  instance vulnerable to this flaw may terminate unexpectedly     when subjected to significant DNS-over-TLS query load. This flaw does not affect DNS-over-HTTPS code, as     that uses a different TLS implementation. (CVE-2023-4236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194665	Fedora 40 : bind / bind-dyndb-ldap (2023-687525fcca)	Nessus	Fedora Local Security Checks	high
185246	Fedora 39 : bind / bind-dyndb-ldap (2023-b4acb0f7c6)	Nessus	Fedora Local Security Checks	high
182885	Fedora 37 : bind / bind-dyndb-ldap (2023-87502c4a93)	Nessus	Fedora Local Security Checks	high
182086	Fedora 38 : bind / bind-dyndb-ldap (2023-a2621f58a9)	Nessus	Fedora Local Security Checks	high
181817	Debian DSA-5504-1 : bind9 - security update	Nessus	Debian Local Security Checks	high
181689	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Bind vulnerabilities (USN-6390-1)	Nessus	Ubuntu Local Security Checks	high
181671	ISC BIND 9.18.0 < 9.18.19 / 9.18.11-S1 < 9.18.19-S1 Assertion Failure (cve-2023-4236)	Nessus	DNS	high

Detections

Analytics

CVE-2023-4236

high

Tenable Plugins

high

high

high

high

high

high

high