SB2023012463 - Red Hat Enterprise Linux 7 update for bind 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023012463

SB2023012463 - Red Hat Enterprise Linux 7 update for bind

Published: January 24, 2023

Security Bulletin ID SB2023012463
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Reliance on Reverse DNS Resolution for a Security-Critical Action (CVE-ID: CVE-2021-25220)

The vulnerability allows a remote attacker to poison DNS cache.

The vulnerability exists due to an error in DNS forwarder implementation. When using forwarders, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incorrect answers. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.



2) Resource management error (CVE-ID: CVE-2022-2795)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing large delegations. A remote attacker can flood the target resolver with queries and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References