CVE-2024-0760 - Vulnerability Details - OpenCVE

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Isc	Bind

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/07/23/1
http://www.openwall.com/lists/oss-security/2024/07/31/2
https://kb.isc.org/docs/cve-2024-0760
https://nvd.nist.gov/vuln/detail/CVE-2024-0760
https://security.netapp.com/advisory/ntap-20240731-0004/
https://www.cve.org/CVERecord?id=CVE-2024-0760

History

Thu, 13 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Isc Isc bind
CPEs		cpe:2.3:a:isc:bind::::::::
Vendors & Products		Isc Isc bind
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: isc

Published: 2024-07-23T14:26:54.983Z

Updated: 2025-02-13T17:27:19.172Z

Reserved: 2024-01-19T20:26:52.962Z

Link: CVE-2024-0760

Vulnrichment

Updated: 2024-08-01T18:18:18.515Z

NVD

Status : Awaiting Analysis

Published: 2024-07-23T15:15:03.520

Modified: 2024-11-21T08:47:18.850

Link: CVE-2024-0760

Redhat

Severity : Important

Publid Date: 2024-07-23T00:00:00Z

Links: CVE-2024-0760 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-0760", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2024-01-19T20:26:52.962Z", "datePublished": "2024-07-23T14:26:54.983Z", "dateUpdated": "2025-02-13T17:27:19.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2024-07-31T11:05:57.323Z"}, "title": "A flood of DNS messages over TCP may make the server unstable", "datePublic": "2024-07-23T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.18.1", "lessThanOrEqual": "9.18.27", "status": "affected", "versionType": "custom"}, {"version": "9.19.0", "lessThanOrEqual": "9.19.24", "status": "affected", "versionType": "custom"}, {"version": "9.18.11-S1", "lessThanOrEqual": "9.18.27-S1", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "The server can become unresponsive until sometime after the attack ends."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "This flaw was discovered in internal testing. We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.28, 9.20.0, or 9.18.28-S1."}], "references": [{"url": "https://kb.isc.org/docs/cve-2024-0760", "name": "CVE-2024-0760", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/31/2"}], "source": {"discovery": "INTERNAL"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "affected": [{"vendor": "isc", "product": "bind", "cpes": ["cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "9.18.1", "status": "affected", "lessThanOrEqual": "9.18.27", "versionType": "custom"}, {"version": "9.19.0", "status": "affected", "lessThanOrEqual": "9.19.24", "versionType": "custom"}, {"version": "9.18.11-s1", "status": "affected", "lessThanOrEqual": "9.18.27-s1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-23T16:02:34.286057Z", "id": "CVE-2024-0760", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T20:36:51.162Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240731-0004/"}, {"url": "https://kb.isc.org/docs/cve-2024-0760", "name": "CVE-2024-0760", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.515Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240731-0004/"}, {"url": "https://kb.isc.org/docs/cve-2024-0760", "name": "CVE-2024-0760", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.515Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0760", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-23T16:02:34.286057Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*"], "vendor": "isc", "product": "bind", "versions": [{"status": "affected", "version": "9.18.1", "versionType": "custom", "lessThanOrEqual": "9.18.27"}, {"status": "affected", "version": "9.19.0", "versionType": "custom", "lessThanOrEqual": "9.19.24"}, {"status": "affected", "version": "9.18.11-s1", "versionType": "custom", "lessThanOrEqual": "9.18.27-s1"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-23T16:07:47.752Z"}}], "cna": {"title": "A flood of DNS messages over TCP may make the server unstable", "source": {"discovery": "INTERNAL"}, "impacts": [{"descriptions": [{"lang": "en", "value": "The server can become unresponsive until sometime after the attack ends."}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.18.1", "versionType": "custom", "lessThanOrEqual": "9.18.27"}, {"status": "affected", "version": "9.19.0", "versionType": "custom", "lessThanOrEqual": "9.19.24"}, {"status": "affected", "version": "9.18.11-S1", "versionType": "custom", "lessThanOrEqual": "9.18.27-S1"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "This flaw was discovered in internal testing. We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.28, 9.20.0, or 9.18.28-S1."}], "datePublic": "2024-07-23T00:00:00.000Z", "references": [{"url": "https://kb.isc.org/docs/cve-2024-0760", "name": "CVE-2024-0760", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/31/2"}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "descriptions": [{"lang": "en", "value": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1."}], "providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2024-07-31T11:05:57.323Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0760", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:27:19.172Z", "dateReserved": "2024-01-19T20:26:52.962Z", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "datePublished": "2024-07-23T14:26:54.983Z", "assignerShortName": "isc"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1."}, {"lang": "es", "value": "Un cliente malintencionado puede enviar muchos mensajes DNS a trav\u00e9s de TCP, lo que podr\u00eda provocar que el servidor se vuelva inestable mientras el ataque est\u00e1 en curso. El servidor puede recuperarse una vez que cese el ataque. El uso de ACL no mitigar\u00e1 el ataque. Este problema afecta a las versiones 9.18.1 a 9.18.27, 9.19.0 a 9.19.24 y 9.18.11-S1 a 9.18.27-S1 de BIND 9."}], "id": "CVE-2024-0760", "lastModified": "2024-11-21T08:47:18.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-officer@isc.org", "type": "Secondary"}]}, "published": "2024-07-23T15:15:03.520", "references": [{"source": "security-officer@isc.org", "url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"source": "security-officer@isc.org", "url": "http://www.openwall.com/lists/oss-security/2024/07/31/2"}, {"source": "security-officer@isc.org", "url": "https://kb.isc.org/docs/cve-2024-0760"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://kb.isc.org/docs/cve-2024-0760"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240731-0004/"}], "sourceIdentifier": "security-officer@isc.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "bind: bind9: A flood of DNS messages over TCP may make the server unstable", "id": "2298878", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298878"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.", "A flaw was found in the bind9 package, where a malicious client may send many DNS messages over the TCP protocol, leading to instabilities on the server side and potentially causing a denial of service. The server will recover automatically once the attack ceases."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-0760", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "bind9.16", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dhcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2024-07-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-0760\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-0760"], "statement": "This vulnerability does not affect the bind and dhcp versions as shipped with Red Hat Enterprise Linux 6, 7, 8 and 9. The bind versions vulnerable to this flaw are 9.18.1 to 9.18.27 and 9.19.0 to 9.19.24, while the most recent bind version in Red Hat Enterprise Linux 9 is bind-9.16.26-11.", "threat_severity": "Important"}