USN-6909-1: Bind vulnerabilities

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• bind9 - Internet Domain Name Server

Details

It was discovered that Bind incorrectly handled a flood of DNS messages
over TCP. A remote attacker could possibly use this issue to cause Bind to
become unstable, resulting in a denial of service. (CVE-2024-0760)

Toshifumi Sakaguchi discovered that Bind incorrectly handled having a very
large number of RRs existing at the same time. A remote attacker could
possibly use this issue to cause Bind to consume resources, leading to a
denial of service. (CVE-2024-1737)

It was discovered that Bind incorrectly handled a large number of SIG(0)
signed requests. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2024-1975)

Daniel Stränger discovered that Bind incorrectly handled serving both
stable cache data and authoritative zone content. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. (CVE-2024-4076)

On Ubuntu 20.04 LTS, Bind has been updated from 9.16 to 9.18. In addition
to security fixes, the updated packages contain bug fixes, new features,
and possibly incompatible changes.

Please see the following for more information:

https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• bind9 - 1:9.18.28-0ubuntu0.24.04.1

Ubuntu 22.04

• bind9 - 1:9.18.28-0ubuntu0.22.04.1

Ubuntu 20.04

• bind9 - 1:9.18.28-0ubuntu0.20.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References

• CVE-2024-1975
• CVE-2024-1737
• CVE-2024-0760
• CVE-2024-4076

Related notices

• USN-6909-2: libbind-export-dev, bind9-doc, dnsutils, libisccc160, libisccc-export160, libisccfg-export160, libisc169, libdns1100, liblwres160, bind9-host, libisc-export169, libdns-export1100, libirs160, libbind9-160, libbind-dev, libirs-export160, bind9utils, libisccfg160, bind9
• USN-6909-3: libbind-export-dev, libisccfg-export140, bind9-doc, libirs-export141, dnsutils, libisccfg140, libisc-export160, libisc160, libdns-export162, bind9-host, libirs141, libisccc-export140-udeb, libdns162, libbind9-140, libisccc-export140, libbind-dev, lwresd, bind9utils, libisccc140, liblwres141, bind9, host