Ubuntu 22.10 LTS: USN-5827-1 Moderate: Bind9 Denial of Service Threat

ubuntu

January 25, 2023

Several security issues were fixed in Bind.

Summary

Several security issues were fixed in Bind.

Software Description:

- bind9: Internet Domain Name Server

Details:

Rob Schulhof discovered that Bind incorrectly handled a large number of

UPDATE messages. A remote attacker could possibly use this issue to cause

Bind to consume resources, resulting in a denial of service.

(CVE-2022-3094)

Borja Marcos discovered that Bind incorrectly handled certain RRSIG

queries. A remote attacker could possibly use this issue to cause Bind to

crash, resulting in a denial of service. This issue only affected Ubuntu

22.04 LTS and Ubuntu 22.10. (CVE-2022-3736)

Maksym Odinintsev discovered that Bind incorrectly handled certain answers

from stale cache. A remote attacker could possibly use this issue to cause

Bind to crash, resulting in a denial of service. This issue only affected

Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3924)

Topics Covered

security advisory denial of service security issue Ubuntu update instructions resource consumption Bind9

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   bind9                           1:9.18.4-2ubuntu2.1

Ubuntu 22.04 LTS:
   bind9                           1:9.18.1-1ubuntu1.3

Ubuntu 20.04 LTS:
   bind9                           1:9.16.1-0ubuntu2.12

In general, a standard system update will make all the necessary changes.