The ISC (Internet Systems Consortium) released a security patch this week in an attempt to address six vulnerabilities that could allow remote attackers to take control of BIND DNS servers.
In total, four of the six vulnerabilities were rated as ‘high severity’ due to their denial of service (DoS) nature.
Here below we have mentioned all the high severity vulnerabilities:-
CVE-2022-2906, the first of these, is a memory leak vulnerability, which has been reported in multiple places. With OpenSSL 3.0.0 and later versions, this vulnerability using TKEY records primarily affects the key processing in Diffie-Hellman mode.
There was also a memory leak in the code for DNSSEC verification in the ECDSA DNSSEC authentication system, which was tracked as CVE-2022-38177. By mismatching a signature length, an attacker may be able to exploit the vulnerability.
An attacker can trigger a small memory leak by spoofing the target resolver to cause responses to be returned with an ECDSA signature that has been tampered with. If you gradually erode the amount of memory available to a named until a point when there is not enough memory there is a chance of named crashing.
Under particular conditions, when specially crafted queries are sent to the BIND 9 resolver, a third issue tracked as CVE-2022-3080 may lead to the resolver crashing as it is unable to resolve the query.
It has been identified that the ECDSA DNSSEC verification code contains a memory leak, which is tracked as CVE-2022-38178, and it’s the fourth high severity vulnerability.
It has been announced that updates have been released for the following:-
Moreover, all these vulnerabilities were not exploited in the wild nor any exploits are available publicly.
ISC has recently issued an advisory on these four security vulnerabilities. CISA has also called on users and administrators to review the advisory as soon as possible in order to fix these holes.
Download Free SWG – Secure Web Filtering – E-book
Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…
Semiconductor companies, pivotal in the tech industry for their role in producing components integral to…
Enterprises are facing heightened cyber threats as attackers increasingly target network infrastructure, particularly routers, following…
Threat actors are using open-source software (OSS) repositories to install malicious code into trusted applications,…
The notorious Tycoon 2FA phishing kit continues its evolution with new strategies designed to slip…
INE Security Highlights How Practical, immersive training environments help defense contractors meet DoD cybersecurity requirements…