Bug 1219852 (CVE-2023-5517)

Summary: VUL-0: CVE-2023-5517: bind: Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled
Product: [Novell Products] SUSE Security Incidents Reporter: Thomas Leroy <thomas.leroy>
Component: IncidentsAssignee: Jorik Cronenberg <jorik.cronenberg>
Status: REOPENED --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: abergmann, galaxy-bugs, meissner, stoyan.manolov
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/393722/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-5517:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Thomas Leroy 2024-02-12 17:08:39 UTC 
New releases of BIND 9 and patches for these vulnerabilities are available via:

- 9.16.48:        https://downloads.isc.org/isc/bind9/private/c1872fb63248b757
- 9.18.24:        https://downloads.isc.org/isc/bind9/private/c791cb32069dbfb6
- 9.19.21:        https://downloads.isc.org/isc/bind9/private/0d0cabccc9841cdd

CVE: CVE-2023-5517

Title: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled

Document version: 1.2

Posting date: 13 February 2024

Program impacted: BIND 9

Versions affected:

BIND

-   9.12.0 -> 9.16.45
-   9.18.0 -> 9.18.21
-   9.19.0 -> 9.19.19

BIND Supported Preview Edition

-   9.16.8-S1 -> 9.16.45-S1
-   9.18.11-S1 -> 9.18.21-S1

Severity: High

Exploitable: Remotely

Description:

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

-   nxdomain-redirect <domain>; is configured, and
-   the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.

Impact:

If both of the above conditions are met, a single suitable query will cause named to crash.

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1.

Workarounds:

Disabling the nxdomain-redirect feature makes the faulty code path impossible to reach, preventing this flaw from being exploitable.

Active exploits:

We are not aware of any active exploits.

Solution:

Upgrade to the patched release most closely related to your current version of BIND 9:

-   9.16.48
-   9.18.24
-   9.19.21

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

-   9.16.48-S1
-   9.18.24-S1

Document revision history:

-   1.0 Early Notification, 10 January 2024
-   1.1 Revised Early Notification, 15 January 2024
-   1.2 Revised the list of fixed versions, 11 February 2024

Related documents:

See our BIND 9 Security Vulnerability Matrix for a complete listing of security vulnerabilities and versions affected.

Do you still have questions? Questions regarding this advisory should be mailed to bind-security@isc.org or posted as confidential GitLab issues at https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue%5Bconfidential%5D=true.

Note:

ISC patches only currently supported versions. When possible we indicate EOL versions affected. For current information on which versions are actively supported, please see https://www.isc.org/download/.

ISC Security Vulnerability Disclosure Policy:

Details of our current security advisory policy and practice can be found in the ISC Software Defect and Security Vulnerability Disclosure Policy at https://kb.isc.org/docs/aa-00861.

The Knowledgebase article https://kb.isc.org/docs/cve-2023-5517 is the complete and official security advisory document.

Legal Disclaimer:

Internet Systems Consortium (ISC) is providing this notice on an “AS IS” basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this notice at any time. A stand-alone copy or paraphrase of the text of this document that omits the document URL is an uncontrolled copy. Uncontrolled copies may lack important information, be out of date, or contain factual errors.
Comment 4 OBSbugzilla Bot 2024-02-13 17:05:05 UTC 
This is an autogenerated message for OBS integration:
This bug (1219852) was mentioned in
https://build.opensuse.org/request/show/1146454 Factory / bind
Comment 6 Thomas Leroy 2024-02-14 09:07:38 UTC 
Affected:

- SUSE:SLE-15-SP3:Update
- SUSE:SLE-15-SP4:Update
- SUSE:SLE-15-SP5:Update
- SUSE:SLE-15:Update
- SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update
- SUSE:ALP:Source:Standard:1.0
- SUSE:SLE-15-SP6:GA
Comment 9 Maintenance Automation 2024-02-21 12:30:20 UTC 
SUSE-SU-2024:0574-1: An update that solves six vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219853, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-5679, CVE-2023-6516
Sources used:
openSUSE Leap 15.5 (src): bind-9.16.48-150500.8.16.1
Basesystem Module 15-SP5 (src): bind-9.16.48-150500.8.16.1
Server Applications Module 15-SP5 (src): bind-9.16.48-150500.8.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Maintenance Automation 2024-02-22 16:30:13 UTC 
SUSE-SU-2024:0590-1: An update that solves six vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219853, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-5679, CVE-2023-6516
Sources used:
openSUSE Leap 15.4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Manager Proxy 4.3 (src): bind-9.16.48-150400.5.40.1
SUSE Manager Retail Branch Server 4.3 (src): bind-9.16.48-150400.5.40.1
SUSE Manager Server 4.3 (src): bind-9.16.48-150400.5.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Marcus Meissner 2024-04-12 13:16:28 UTC 
- SUSE:SLE-15-SP3:Update
- SUSE:SLE-15:Update

missing
Comment 18 Maintenance Automation 2024-06-11 12:31:00 UTC 
SUSE-SU-2024:1982-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-6516
Maintenance Incident: [SUSE:Maintenance:34202](https://smelt.suse.de/incident/34202/)
Sources used:
SUSE Enterprise Storage 7.1 (src):
 bind-9.16.6-150300.22.44.1
openSUSE Leap 15.3 (src):
 bind-9.16.6-150300.22.44.1
Basesystem Module 15-SP6 (src):
 bind-9.16.6-150300.22.44.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 bind-9.16.6-150300.22.44.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 bind-9.16.6-150300.22.44.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 bind-9.16.6-150300.22.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Maintenance Automation 2024-06-17 08:30:34 UTC 
SUSE-SU-2024:2033-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-6516
Maintenance Incident: [SUSE:Maintenance:34201](https://smelt.suse.de/incident/34201/)
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2
SUSE Manager Client Tools for SLE Micro 5 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.