SecuriTricks - CVE-2024-1737

Description

Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.

Product(s) Impacted

Product	Versions
BIND	['9.11.0 - 9.11.37', '9.16.0 - 9.16.50', '9.18.0 - 9.18.27', '9.19.0 - 9.19.24', '9.11.4-S1 - 9.11.37-S1', '9.16.8-S1 - 9.16.50-S1', '9.18.11-S1 - 9.18.27-S1']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

http://www.openwall.com/lists/oss-security/2024/07/23/1

https://kb.isc.org/docs/cve-2024-1737

https://kb.isc.org/docs/rrset-limits-in-zones

CVSS Score

7.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: July 23, 2024, 3:15 p.m.
Last Modified: July 23, 2024, 4:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-officer@isc.org

CVE-2024-1737