CVE-2024-33655

June 6, 2024, 5:15 p.m.

None
No Score

Description

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.

Product(s) Impacted

Product Versions
DNS Servers implementing RFC 1035

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://alas.aws.amazon.com/ALAS-2024-1934.html
https://datatracker.ietf.org/doc/html/rfc1035
https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de
https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120
https://gitlab.isc.org/isc-projects/bind9/-/issues/4398
https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/
https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
https://nlnetlabs.nl/projects/unbound/security-advisories/
https://sp2024.ieee-security.org/accepted-papers.html
https://www.isc.org/blogs/2024-dnsbomb/

Tags

cve@mitre.org
2024-06-06
CVE-2024-33655

Timeline

Published: June 6, 2024, 5:15 p.m.
Last Modified: June 6, 2024, 5:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.