SB2023011644 - IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for ISC BIND 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023011644

SB2023011644 - IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for ISC BIND

Published: January 16, 2023

Security Bulletin ID SB2023011644
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Buffer overflow (CVE-ID: CVE-2021-25216)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the GSS-TSIG extension. A remote attacker can send specially crafted requests to the server, trigger buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability requires that named is configure to use SPNEGO implementation by setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options (often used with Samba as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers).


Remediation

Install update from vendor's website.

References