CVE-2023-5679

A flaw was found in the bind package. This issue may allow an attacker to query in a DNS64 enabled resolver node with a domain name triggering a server-stale data, triggering a code assertion, and resulting in a crash of named processes. This can allow a remote unauthenticated user to cause a Denial Of Service in the DNS server.

The identified vulnerability in the BIND DNS server poses a important severity risk due to its potential to induce a Denial of Service (DoS) through a targeted exploitation of DNS64 functionality. Specifically, the flaw allows an attacker to send a crafted domain query that triggers a code assertion failure within the named process. This leads to a crash of the DNS server, disrupting its ability to resolve queries and maintain network operations. As a result, the DNS service becomes unavailable to legitimate users, impacting the integrity and availability of network services and potentially disrupting business operations or network communications. The exploitation of this vulnerability by an unauthenticated remote user underscores the urgent need for immediate patching and mitigation to safeguard DNS infrastructure against service outages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability can be mitigated by either disabled server-stale configuration, using both of the switches bellow in named configuration file:

1. set stale-cache-enable no;
2. set stale-answer-enable no;

Alternatively, disable the DNS64 option. Both mitigations should make the affected code unreachable, making it impossible to an attacker to exploit this vulnerability.