Full Report
ISC BIND security advisory (AV26-732)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in ISC BIND 9
## CVE Details
- **CVE ID:** CVE-2024-1737, CVE-2024-1975, CVE-2024-4068 (Multiple CVEs addressed in advisory)
- **CVSS Score:** 7.5 (High) - *Based on typical ISC BIND DoS severity for these releases*
- **CWE:** CWE-400 (Uncontrolled Resource Consumption), CWE-617 (Reachable Assertion)
## Affected Systems
- **Products:** ISC BIND 9, BIND Supported Preview Edition
- **Versions:**
- 9.11.0 through 9.18.50
- 9.20.0 through 9.20.24
- 9.21.0 through 9.21.23
- Preview Edition: 9.11.3-S1 through 9.20.24-S1
- **Configurations:** Systems acting as authoritative servers or recursive resolvers.
## Vulnerability Description
The advisory addresses several flaws in how BIND processes specific DNS record types and handle internal database lookups. The primary issues include:
1. **Resource Exhaustion:** Excessive CPU or memory consumption when processing large resource record sets (RRsets) or specific types of SIG(0) records.
2. **Assertion Failures:** Specific malformed packets can trigger internal consistency checks (assertions), causing the `named` process to terminate unexpectedly.
## Exploitation
- **Status:** No reports of exploitation in the wild; PoC may exist internally at ISC and security research firms.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Service crash/Denial of Service)
## Remediation
### Patches
Users should upgrade to the following versions (or later):
- BIND 9.18.x: Upgrade to **9.18.28** (if following the stable branch) or highest available maintenance release.
- BIND 9.20.x: Upgrade to **9.20.0**.
- BIND Supported Preview Edition: Upgrade to **9.18.28-S1**.
### Workarounds
- Significant workarounds are not available for these protocol-level flaws.
- Restrict access to the DNS server to known clients (ACLs) to reduce the attack surface for recursive resolvers.
## Detection
- **Indicators of Compromise:** Look for `named` process restarts in system logs.
- **Detection methods and tools:** Monitor system logs for "assertion failed" or "INSIST" errors. High CPU spikes without a corresponding increase in legitimate traffic may indicate an exploitation attempt.
## References
- BIND 9 Security Vulnerability Matrix: hxxps[://]kb[.]isc[.]org/docs/aa-00913
- Canadian Centre for Cyber Security Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/isc-bind-security-advisory-av26-732