Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Bind Vulnerability: Authentication Bypass in DNS Server

published 2 years ago

Summary

A vulnerability in the Bind DNS server can allow an attacker to bypass authentication and access the server. This affects systems running Bind on Red Hat Enterprise Linux. To protect your system, apply the latest security update as soon as possible.

What to do

Update redhat bind to version 32:9.16.23-1.el9_0.7.
Update redhat bind-chroot to version 32:9.16.23-1.el9_0.7.
Update redhat bind-debuginfo to version 32:9.16.23-1.el9_0.7.
Update redhat bind-debugsource to version 32:9.16.23-1.el9_0.7.
Update redhat bind-dnssec-doc to version 32:9.16.23-1.el9_0.7.
Update redhat bind-dnssec-utils to version 32:9.16.23-1.el9_0.7.
Update redhat bind-dnssec-utils-debuginfo to version 32:9.16.23-1.el9_0.7.
Update redhat bind-dyndb-ldap to version 0:11.9-7.el9_0.3.
Update redhat bind-dyndb-ldap-debuginfo to version 0:11.9-7.el9_0.3.
Update redhat bind-dyndb-ldap-debugsource to version 0:11.9-7.el9_0.3.
Update redhat bind-libs to version 32:9.16.23-1.el9_0.7.
Update redhat bind-libs-debuginfo to version 32:9.16.23-1.el9_0.7.
Update redhat bind-license to version 32:9.16.23-1.el9_0.7.
Update redhat bind-utils to version 32:9.16.23-1.el9_0.7.
Update redhat bind-utils-debuginfo to version 32:9.16.23-1.el9_0.7.
Update redhat python3-bind to version 32:9.16.23-1.el9_0.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.0::appstream	redhat	bind	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-chroot	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-debuginfo	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-debugsource	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-dnssec-doc	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-dnssec-utils	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-dnssec-utils-debuginfo	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-dyndb-ldap	< 0:11.9-7.el9_0.3 Fix: upgrade to 0:11.9-7.el9_0.3
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-dyndb-ldap-debuginfo	< 0:11.9-7.el9_0.3 Fix: upgrade to 0:11.9-7.el9_0.3
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-dyndb-ldap-debugsource	< 0:11.9-7.el9_0.3 Fix: upgrade to 0:11.9-7.el9_0.3
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-libs	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-libs-debuginfo	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-license	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-utils	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	bind-utils-debuginfo	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7
Red Hat:rhel_e4s:9.0::appstream	redhat	python3-bind	< 32:9.16.23-1.el9_0.7 Fix: upgrade to 32:9.16.23-1.el9_0.7

Original advisory text

Red Hat Security Advisory: bind and bind-dyndb-ldap security update

References

https://access.redhat.com/errata/RHSA-2024:5907 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2298893 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2298901 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2298904 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5907.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-1737 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-1737 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-1737 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-1975 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-1975 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-1975 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-4076 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-4076 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4076 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published27 Sep 2024

Updated25 Mar 2026

First seen25 Mar 2026

Sources

RHSA-2024:5907 · OSV

Track software like this

Free during beta