CVE-2023-3341

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-3341
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3341.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-3341
Downstream
Related
Published
2023-09-20T13:15:11.770Z
Modified
2026-07-08T07:16:23.005800297Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                },
                {
                    "introduced": "11.0"
                },
                {
                    "last_affected": "11.0"
                }
            ],
            "vendor_product": "debian:debian_linux",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "37"
                },
                {
                    "last_affected": "37"
                },
                {
                    "introduced": "38"
                },
                {
                    "last_affected": "38"
                }
            ],
            "vendor_product": "fedoraproject:fedora",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.35:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.3:s4:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.12:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.43:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.18.0:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.18.18:s1:*:*:supported_preview:*:*:*",
                "cpe:2.3:a:isc:bind:9.9.13:s1:*:*:supported_preview:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.9.13-s1"
                },
                {
                    "last_affected": "9.9.13-s1"
                },
                {
                    "introduced": "9.9.13-s1"
                },
                {
                    "last_affected": "9.9.13-s1"
                },
                {
                    "introduced": "9.11.3-s4"
                },
                {
                    "last_affected": "9.11.3-s4"
                },
                {
                    "introduced": "9.11.3-s4"
                },
                {
                    "last_affected": "9.11.3-s4"
                },
                {
                    "introduced": "9.11.5-s3"
                },
                {
                    "last_affected": "9.11.5-s3"
                },
                {
                    "introduced": "9.11.5-s3"
                },
                {
                    "last_affected": "9.11.5-s3"
                },
                {
                    "introduced": "9.11.5-s5"
                },
                {
                    "last_affected": "9.11.5-s5"
                },
                {
                    "introduced": "9.11.5-s5"
                },
                {
                    "last_affected": "9.11.5-s5"
                },
                {
                    "introduced": "9.11.5-s6"
                },
                {
                    "last_affected": "9.11.5-s6"
                },
                {
                    "introduced": "9.11.5-s6"
                },
                {
                    "last_affected": "9.11.5-s6"
                },
                {
                    "introduced": "9.11.7-s1"
                },
                {
                    "last_affected": "9.11.7-s1"
                },
                {
                    "introduced": "9.11.7-s1"
                },
                {
                    "last_affected": "9.11.7-s1"
                },
                {
                    "introduced": "9.11.8-s1"
                },
                {
                    "last_affected": "9.11.8-s1"
                },
                {
                    "introduced": "9.11.8-s1"
                },
                {
                    "last_affected": "9.11.8-s1"
                },
                {
                    "introduced": "9.11.12-s1"
                },
                {
                    "last_affected": "9.11.12-s1"
                },
                {
                    "introduced": "9.11.12-s1"
                },
                {
                    "last_affected": "9.11.12-s1"
                },
                {
                    "introduced": "9.11.21-s1"
                },
                {
                    "last_affected": "9.11.21-s1"
                },
                {
                    "introduced": "9.11.21-s1"
                },
                {
                    "last_affected": "9.11.21-s1"
                },
                {
                    "introduced": "9.11.27-s1"
                },
                {
                    "last_affected": "9.11.27-s1"
                },
                {
                    "introduced": "9.11.27-s1"
                },
                {
                    "last_affected": "9.11.27-s1"
                },
                {
                    "introduced": "9.11.29-s1"
                },
                {
                    "last_affected": "9.11.29-s1"
                },
                {
                    "introduced": "9.11.29-s1"
                },
                {
                    "last_affected": "9.11.29-s1"
                },
                {
                    "introduced": "9.11.35-s1"
                },
                {
                    "last_affected": "9.11.35-s1"
                },
                {
                    "introduced": "9.11.35-s1"
                },
                {
                    "last_affected": "9.11.35-s1"
                },
                {
                    "introduced": "9.11.37-s1"
                },
                {
                    "last_affected": "9.11.37-s1"
                },
                {
                    "introduced": "9.11.37-s1"
                },
                {
                    "last_affected": "9.11.37-s1"
                },
                {
                    "introduced": "9.16.8-s1"
                },
                {
                    "last_affected": "9.16.8-s1"
                },
                {
                    "introduced": "9.16.8-s1"
                },
                {
                    "last_affected": "9.16.8-s1"
                },
                {
                    "introduced": "9.16.11-s1"
                },
                {
                    "last_affected": "9.16.11-s1"
                },
                {
                    "introduced": "9.16.11-s1"
                },
                {
                    "last_affected": "9.16.11-s1"
                },
                {
                    "introduced": "9.16.12-s1"
                },
                {
                    "last_affected": "9.16.12-s1"
                },
                {
                    "introduced": "9.16.12-s1"
                },
                {
                    "last_affected": "9.16.12-s1"
                },
                {
                    "introduced": "9.16.13-s1"
                },
                {
                    "last_affected": "9.16.13-s1"
                },
                {
                    "introduced": "9.16.13-s1"
                },
                {
                    "last_affected": "9.16.13-s1"
                },
                {
                    "introduced": "9.16.14-s1"
                },
                {
                    "last_affected": "9.16.14-s1"
                },
                {
                    "introduced": "9.16.14-s1"
                },
                {
                    "last_affected": "9.16.14-s1"
                },
                {
                    "introduced": "9.16.21-s1"
                },
                {
                    "last_affected": "9.16.21-s1"
                },
                {
                    "introduced": "9.16.21-s1"
                },
                {
                    "last_affected": "9.16.21-s1"
                },
                {
                    "introduced": "9.16.32-s1"
                },
                {
                    "last_affected": "9.16.32-s1"
                },
                {
                    "introduced": "9.16.32-s1"
                },
                {
                    "last_affected": "9.16.32-s1"
                },
                {
                    "introduced": "9.16.36-s1"
                },
                {
                    "last_affected": "9.16.36-s1"
                },
                {
                    "introduced": "9.16.36-s1"
                },
                {
                    "last_affected": "9.16.36-s1"
                },
                {
                    "introduced": "9.16.43-s1"
                },
                {
                    "last_affected": "9.16.43-s1"
                },
                {
                    "introduced": "9.16.43-s1"
                },
                {
                    "last_affected": "9.16.43-s1"
                },
                {
                    "introduced": "9.18.0-s1"
                },
                {
                    "last_affected": "9.18.0-s1"
                },
                {
                    "introduced": "9.18.0-s1"
                },
                {
                    "last_affected": "9.18.0-s1"
                },
                {
                    "introduced": "9.18.18-s1"
                },
                {
                    "last_affected": "9.18.18-s1"
                },
                {
                    "introduced": "9.18.18-s1"
                },
                {
                    "last_affected": "9.18.18-s1"
                }
            ],
            "vendor_product": "isc:bind",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://github.com/isc-projects/bind9
Events
Introduced
fd212b709580a72a8e168b632d7dc863e61a14e4
Fixed
cd2b4602b03027790908c2870b8a42c0870de489
Introduced
8db45afa1affcb823e68afdeddedf93e136f5d3e
Fixed
c78cd3681c406955961d0b3c67ab6da7c6043aa8
Introduced
cab15392afd841fe3b0bacd894003376d857459a
Fixed
464cf8ce5e881e487e34666ea39170aaee29c246
Introduced
1c59cea1c0e26e2da3f2afb90200bfe9f7748c03
Last affected
eba38b89007f65bc6c1fdd2451034bbe3908b9a4
Database specific 
{
    "cpe": [
        "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.2.0"
        },
        {
            "fixed": "9.16.44"
        },
        {
            "introduced": "9.18.0"
        },
        {
            "fixed": "9.18.19"
        },
        {
            "introduced": "9.19.0"
        },
        {
            "fixed": "9.19.17"
        },
        {
            "introduced": "9.9.3-s1"
        },
        {
            "last_affected": "9.9.3-s1"
        },
        {
            "introduced": "9.9.12-s1"
        },
        {
            "last_affected": "9.9.12-s1"
        },
        {
            "introduced": "9.10.5-s1"
        },
        {
            "last_affected": "9.10.5-s1"
        },
        {
            "introduced": "9.10.7-s1"
        },
        {
            "last_affected": "9.10.7-s1"
        },
        {
            "introduced": "9.11.3-s1"
        },
        {
            "last_affected": "9.11.3-s1"
        },
        {
            "introduced": "9.11.4-s1"
        },
        {
            "last_affected": "9.11.4-s1"
        },
        {
            "introduced": "9.11.6-s1"
        },
        {
            "last_affected": "9.11.6-s1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

9.*
9.10.5-s1
9.10.7-s1
9.11.3-s1
9.11.4-s1
9.11.6-s1
9.9.12-s1
9.9.3-s1
v9.*
v9.18.0
v9.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3341.json"

Git / gitlab.isc.org/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://gitlab.isc.org/isc-projects/bind9
Events
Introduced
fd212b709580a72a8e168b632d7dc863e61a14e4
Fixed
cd2b4602b03027790908c2870b8a42c0870de489
Introduced
8db45afa1affcb823e68afdeddedf93e136f5d3e
Fixed
c78cd3681c406955961d0b3c67ab6da7c6043aa8
Introduced
cab15392afd841fe3b0bacd894003376d857459a
Fixed
464cf8ce5e881e487e34666ea39170aaee29c246
Introduced
1c59cea1c0e26e2da3f2afb90200bfe9f7748c03
Last affected
eba38b89007f65bc6c1fdd2451034bbe3908b9a4
Database specific 
{
    "cpe": [
        "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:*",
        "cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.2.0"
        },
        {
            "fixed": "9.16.44"
        },
        {
            "introduced": "9.18.0"
        },
        {
            "fixed": "9.18.19"
        },
        {
            "introduced": "9.19.0"
        },
        {
            "fixed": "9.19.17"
        },
        {
            "introduced": "9.9.3-s1"
        },
        {
            "last_affected": "9.9.3-s1"
        },
        {
            "introduced": "9.9.12-s1"
        },
        {
            "last_affected": "9.9.12-s1"
        },
        {
            "introduced": "9.10.5-s1"
        },
        {
            "last_affected": "9.10.5-s1"
        },
        {
            "introduced": "9.10.7-s1"
        },
        {
            "last_affected": "9.10.7-s1"
        },
        {
            "introduced": "9.11.3-s1"
        },
        {
            "last_affected": "9.11.3-s1"
        },
        {
            "introduced": "9.11.4-s1"
        },
        {
            "last_affected": "9.11.4-s1"
        },
        {
            "introduced": "9.11.6-s1"
        },
        {
            "last_affected": "9.11.6-s1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

9.*
9.10.5-s1
9.10.7-s1
9.11.3-s1
9.11.4-s1
9.11.6-s1
9.9.12-s1
9.9.3-s1
v9.*
v9.18.0
v9.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3341.json"