==========================================================================
Ubuntu Security Notice USN-6909-1
July 23, 2024

bind9 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Bind.

Software Description:
- bind9: Internet Domain Name Server

Details:

It was discovered that Bind incorrectly handled a flood of DNS messages
over TCP. A remote attacker could possibly use this issue to cause Bind to
become unstable, resulting in a denial of service. (CVE-2024-0760)

Toshifumi Sakaguchi discovered that Bind incorrectly handled having a very
large number of RRs existing at the same time. A remote attacker could
possibly use this issue to cause Bind to consume resources, leading to a
denial of service. (CVE-2024-1737)

It was discovered that Bind incorrectly handled a large number of SIG(0)
signed requests. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2024-1975)

Daniel Stränger discovered that Bind incorrectly handled serving both
stable cache data and authoritative zone content. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. (CVE-2024-4076)

On Ubuntu 20.04 LTS, Bind has been updated from 9.16 to 9.18. In addition
to security fixes, the updated packages contain bug fixes, new features,
and possibly incompatible changes.

Please see the following for more information:

https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   bind9                           1:9.18.28-0ubuntu0.24.04.1

Ubuntu 22.04 LTS
   bind9                           1:9.18.28-0ubuntu0.22.04.1

Ubuntu 20.04 LTS
   bind9                           1:9.18.28-0ubuntu0.20.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References:
   https://ubuntu.com/security/notices/USN-6909-1
   CVE-2024-0760, CVE-2024-1737, CVE-2024-1975, CVE-2024-4076

Package Information:
   https://launchpad.net/ubuntu/+source/bind9/1:9.18.28-0ubuntu0.24.04.1
   https://launchpad.net/ubuntu/+source/bind9/1:9.18.28-0ubuntu0.22.04.1
   https://launchpad.net/ubuntu/+source/bind9/1:9.18.28-0ubuntu0.20.04.1