CVE-2023-2911

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2911
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/06/21/6 Mailing List Patch Third Party Advisory
https://kb.isc.org/docs/cve-2023-2911 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEFCEVCTYEMKTWA7V7EYPI5YQQ4JWDLI/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3K6AJK7RRSR53HRF5GGKPA6PDUDWOD2/ Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20230703-0010/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5439 Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/06/21/6 Mailing List Patch Third Party Advisory
https://kb.isc.org/docs/cve-2023-2911 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEFCEVCTYEMKTWA7V7EYPI5YQQ4JWDLI/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3K6AJK7RRSR53HRF5GGKPA6PDUDWOD2/ Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20230703-0010/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5439 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:59

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/06/21/6 - Mailing List, Patch, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/06/21/6 - Mailing List, Patch, Third Party Advisory
References () https://kb.isc.org/docs/cve-2023-2911 - Vendor Advisory () https://kb.isc.org/docs/cve-2023-2911 - Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEFCEVCTYEMKTWA7V7EYPI5YQQ4JWDLI/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEFCEVCTYEMKTWA7V7EYPI5YQQ4JWDLI/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3K6AJK7RRSR53HRF5GGKPA6PDUDWOD2/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3K6AJK7RRSR53HRF5GGKPA6PDUDWOD2/ - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230703-0010/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230703-0010/ - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5439 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5439 - Third Party Advisory

03 Jul 2023, 19:09

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-21 17:15

Updated : 2024-11-21 07:59

NVD link : CVE-2023-2911

Mitre link : CVE-2023-2911

CVE.ORG link : CVE-2023-2911

JSON object : View

Products Affected

fedoraproject

  • fedora

netapp

  • h500s
  • h300s_firmware
  • h300s
  • h410c
  • h410s
  • h700s
  • h410c_firmware
  • h410s_firmware
  • h500s_firmware
  • active_iq_unified_manager
  • h700s_firmware

debian

  • debian_linux

isc

  • bind
CWE
CWE-787

Out-of-bounds Write