CVE-2023-2829 : A `named` instance configured to run as a DNSSEC-validating recursive resolver w

A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.

Published 2023-06-21 17:15:48

Updated 2023-07-03 19:11:00

Source Internet Systems Consortium (ISC)

View at NVD, CVE.org

Products affected by CVE-2023-2829

ISC » Bind » Supported Preview Edition
Versions from including (>=) 9.18.11 and up to, including, (<=) 9.18.15
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*
Matching versions
ISC » Bind » Supported Preview Edition
Versions from including (>=) 9.16.8 and up to, including, (<=) 9.16.41
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vmware Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Netapp » H300s Firmware » Version: N/A
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300s » Version: N/A
Netapp » H500s Firmware » Version: N/A
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500s » Version: N/A
Netapp » H700s Firmware » Version: N/A
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700s » Version: N/A
Netapp » H410s Firmware » Version: N/A
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410s » Version: N/A

Threat overview for CVE-2023-2829

Top countries where our scanners detected CVE-2023-2829

Top open port discovered on systems with this issue 53

IPs affected by CVE-2023-2829 101,901

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2023-2829!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2023-2829

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-2829

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Internet Systems Consortium (ISC)
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2023-2829

https://security.netapp.com/advisory/ntap-20230703-0010/

June 2023 ISC BIND Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://kb.isc.org/docs/cve-2023-2829

CVE-2023-2829
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-2829

Products affected by CVE-2023-2829

Threat overview for CVE-2023-2829

Exploit prediction scoring system (EPSS) score for CVE-2023-2829

CVSS scores for CVE-2023-2829

References for CVE-2023-2829