CVE-2024-0760

NameCVE-2024-0760
DescriptionA malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)jessie, jessie (lts)1:9.9.5.dfsg-9+deb8u31fixed
stretch (security)1:9.10.3.dfsg.P4-12.3+deb9u12fixed
stretch (lts), stretch1:9.10.3.dfsg.P4-12.3+deb9u16fixed
buster, buster (lts)1:9.11.5.P4+dfsg-5.1+deb10u13fixed
buster (security)1:9.11.5.P4+dfsg-5.1+deb10u11fixed
bullseye1:9.16.50-1~deb11u2fixed
bullseye (security)1:9.16.50-1~deb11u1fixed
bookworm (security), bookworm1:9.18.28-1~deb12u2fixed
sid, trixie1:9.20.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bind9sourcejessie(not affected)
bind9sourcestretch(not affected)
bind9sourcebuster(not affected)
bind9sourcebullseye(not affected)
bind9sourcebookworm1:9.18.28-1~deb12u1
bind9source(unstable)1:9.20.0-1

Notes

[bullseye] - bind9 <not-affected> (Vulnerable code introduced in 9.18 branch)
https://kb.isc.org/docs/cve-2024-0760
[buster] - bind9 <not-affected> (Vulnerable code introduced in 9.18 branch)
[stretch] - bind9 <not-affected> (Vulnerable code introduced in 9.18 branch)
[jessie] - bind9 <not-affected> (Vulnerable code introduced in 9.18 branch)

Search for package or bug name: Reporting problems