SB2022112933 - IBM i update for ISC BIND

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Resource management error (CVE-ID: CVE-2022-2795)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing large delegations. A remote attacker can flood the target resolver with queries and perform a denial of service (DoS) attack.

2) Memory leak (CVE-ID: CVE-2022-38177)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the DNSSEC verification code for the ECDSA algorithm. A remote attacker can spoof the target resolver with responses that have a malformed ECDSA signature and perform denial of service attack.

3) Memory leak (CVE-ID: CVE-2022-38178)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the DNSSEC verification code for the EdDSA algorithm. A remote attacker can spoof the target resolver with responses that have a malformed EdDSA signature and perform denial of service attack.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/blogs/psirt/security-bulletin-isc-bind-on-ibm-i-is-vulnerable-to-denial-of-service-due-to-memory-leaks-and-a-flaw-in-resolver-code-cve-2022-2795-cve-2022-38177-cve-2022-38178/"
• https://www.ibm.com/blogs/psirt/security-bulletin-isc-bind-on-ibm-i-is-vulnerable-to-denial-of-service-due-to-memory-leaks-and-a-flaw-in-resolver-code-cve-2022-2795-cve-2022-38177-cve-2022-38178/</a></p><p>
• https://www.ibm.com/support/pages/node/6841885</p><p><br></p>