CVE-2024-0760

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. 
This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
iscCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA-ADPADP
---
---
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Debian logo
Debian Releases
Debian Product
Codename
bind9
bullseye
1:9.16.50-1~deb11u2
not-affected
bullseye (security)
1:9.16.50-1~deb11u3
fixed
bookworm
1:9.18.33-1~deb12u2
fixed
bookworm (security)
1:9.18.33-1~deb12u2
fixed
trixie
1:9.20.9-1
fixed
sid
1:9.20.9-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bind9
plucky
Fixed 1:9.18.28-0ubuntu1
released
oracular
Fixed 1:9.18.28-0ubuntu1
released
noble
Fixed 1:9.18.28-0ubuntu0.24.04.1
released
jammy
Fixed 1:9.18.28-0ubuntu0.22.04.1
released
focal
Fixed 1:9.18.28-0ubuntu0.20.04.1
released
bionic
not-affected
xenial
not-affected
trusty
not-affected
bind9-libs
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
isc-dhcp
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
not-affected
focal
not-affected
bionic
needs-triage
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2024/07/23/1
http://www.openwall.com/lists/oss-security/2024/07/31/2
https://kb.isc.org/docs/cve-2024-0760
http://www.openwall.com/lists/oss-security/2024/07/23/1
https://kb.isc.org/docs/cve-2024-0760
https://security.netapp.com/advisory/ntap-20240731-0004/