IBM i update for ISC BIND

1) Resource management error

EUVDB-ID: #VU67545

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-2795

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing large delegations. A remote attacker can flood the target resolver with queries and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM i: 7.2 - 7.5

CPE2.3

External links

https://www.ibm.com/blogs/psirt/security-bulletin-isc-bind-on-ibm-i-is-vulnerable-to-denial-of-service-due-to-memory-leaks-and-a-flaw-in-resolver-code-cve-2022-2795-cve-2022-38177-cve-2022-38178/
https://www.ibm.com/support/pages/node/6841885

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU67549

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-38177

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the DNSSEC verification code for the ECDSA algorithm. A remote attacker can spoof the target resolver with responses that have a malformed ECDSA signature and perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM i: 7.2 - 7.5

CPE2.3

External links

https://www.ibm.com/blogs/psirt/security-bulletin-isc-bind-on-ibm-i-is-vulnerable-to-denial-of-service-due-to-memory-leaks-and-a-flaw-in-resolver-code-cve-2022-2795-cve-2022-38177-cve-2022-38178/
https://www.ibm.com/support/pages/node/6841885

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU67550

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-38178

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the DNSSEC verification code for the EdDSA algorithm. A remote attacker can spoof the target resolver with responses that have a malformed EdDSA signature and perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM i: 7.2 - 7.5

CPE2.3

External links

https://www.ibm.com/blogs/psirt/security-bulletin-isc-bind-on-ibm-i-is-vulnerable-to-denial-of-service-due-to-memory-leaks-and-a-flaw-in-resolver-code-cve-2022-2795-cve-2022-38177-cve-2022-38178/
https://www.ibm.com/support/pages/node/6841885

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-2795 CVE-2022-38177 CVE-2022-38178
CWE-ID	CWE-399 CWE-401
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	IBM i Operating systems & Components / Operating system
Vendor	IBM Corporation