CVE-2023-50387
published 2024-02-14CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU…
PriorityP358high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
100.00%
100.0th percentile
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Affected
60 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cz.nic | knot-resolver | >= 0 < 5.6.0-1+deb12u1 | 5.6.0-1+deb12u1 |
| cz.nic | knot-resolver | >= 0 < 5.7.1-1 | 5.7.1-1 |
| cz.nic | knot-resolver | >= 0 < 5.7.1-1 | 5.7.1-1 |
| debian | bind9 | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| debian | dnsjava | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| debian | dnsmasq | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| debian | knot-resolver | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| debian | pdns-recursor | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| debian | systemd | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| debian | unbound | < bind9 1:9.18.24-1 (bookworm) | bind9 1:9.18.24-1 (bookworm) |
| fedoraproject | fedora | — | — |
| isc | bind | 9.0.0 – 9.16.46 | — |
| isc | bind | 9.18.0 – 9.18.22 | — |
| isc | bind | 9.19.0 – 9.19.20 | — |
| isc | bind9 | >= 0 < 1:9.16.48-1 | 1:9.16.48-1 |
| isc | bind9 | >= 0 < 1:9.18.24-1 | 1:9.18.24-1 |
| isc | bind9 | >= 0 < 1:9.19.21-1 | 1:9.19.21-1 |
| isc | bind9 | >= 0 < 1:9.19.21-1 | 1:9.19.21-1 |
| isc | bind9 | >= 0 < 1:9.16.48-0ubuntu0.20.04.1 | 1:9.16.48-0ubuntu0.20.04.1 |
| isc | bind9 | >= 0 < 1:9.18.18-0ubuntu0.22.04.2 | 1:9.18.18-0ubuntu0.22.04.2 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-3ubuntu0.19+esm12 | 1:9.9.5.dfsg-3ubuntu0.19+esm12 |
| isc | bind9 | >= 0 < 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8 | 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8 |
| isc | bind9 | >= 0 < 1:9.11.3+dfsg-1ubuntu1.19+esm3 | 1:9.11.3+dfsg-1ubuntu1.19+esm3 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor DNS resolvers for sustained or unexplained high CPU usage, which may indicate active KeyTrap exploitation via excessive DNSSEC cryptographic validation. ↗
- →Detect DNS responses containing unusually large numbers of DNSKEY and RRSIG records — a single malicious response can trigger millions of cryptographic operations on the resolver. ↗
- →Alert on DNS query timeouts or resolution failures across client networks, which may indicate a resolver is stalled due to KeyTrap exploitation. ↗
- →Use resolver debug or query logs to identify repetitive DNSSEC validation loops, a behavioral indicator of KeyTrap exploitation. ↗
- →Correlate in SIEM: anomalous resolver CPU spikes linked to DNSSEC validation routines, especially when tied to queries toward unknown or suspicious authoritative servers. ↗
- →Monitor for outbound connections from resolvers to unexpected authoritative servers, which may indicate redirection to a malicious DNSSEC zone serving crafted responses. ↗
- →A single DNS packet causing a ~2,000,000x spike in CPU instruction count is the key behavioral signature of KeyTrap; network-level monitoring for oversized DNSSEC payloads in a single response packet can serve as a detection trigger. ↗
- →Identify DNS responses where key tag collisions are present — multiple DNSKEY records sharing identical (zone name, algorithm, key tag) triples in a single response are a strong indicator of a crafted KeyTrap payload. ↗
- →Flag DNS responses containing multiple RRSIG records for the same RRset — this is a prerequisite for the multiple-signatures variant of the KeyTrap attack. ↗
- ·Akamai's mitigation limits cryptographic failures to a maximum of 32 per validation attempt, which effectively prevents CPU exhaustion; this threshold can serve as a reference for tuning similar limits in other resolver implementations. ↗
- ·The vulnerability is rooted in the DNSSEC protocol specification itself (RFC 4033/4034/4035/6840), not just implementation bugs — patching resolvers mitigates the risk but does not fully resolve the underlying protocol design flaw. ↗
- ·Approximately 35% of US-based and 30% of worldwide internet users rely on DNSSEC-validating resolvers, meaning a large fraction of resolvers remain exposed if unpatched. ↗
- ·The attack requires the adversary to operate or control a malicious authoritative DNS zone serving crafted DNSSEC responses; exploitation does not require a man-in-the-middle position. ↗
- ·The stall duration varies significantly by resolver implementation — from 56 seconds to up to 16 hours — so detection thresholds for CPU exhaustion alerts should be tuned per resolver type. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC INS
cisa_ics·2024-11-14
Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Release DateNovember 14, 2024
Alert CodeICSA-24-319-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.9
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Authentication, Out-of-bounds Write, Ineffici
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2024-04-24·CVSS 7.5
CVE-2023-50387 [HIGH] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
USN-6657-1 fixed several vulnerabilities in Dnsmasq. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)
It was discovered that Dnsmasq incor
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2024-04-09·CVSS 7.5
CVE-2023-50387 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Bind could be made to crash if it received specially crafted
input.
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2023-50868)
Instructions: In general, a standard system update will make all the necessary changes.
BSD
FreeBSD-SA-24:03.unbound: Multiple vulnerabilities in unbound
bsd_advisories·2024-03-28·CVSS 7.5
CVE-2023-50387 [HIGH] FreeBSD-SA-24:03.unbound: Multiple vulnerabilities in unbound
FreeBSD-SA-24:03.unbound Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in unbound
Category: contrib
Module: unbound
Announced: 2024-03-28
Affects: FreeBSD 13.2 and FreeBSD 14.0
Corrected: 2024-02-17 13:45:44 UTC (stable/14, 14.0-STABLE)
2024-03-28 05:06:26 UTC (releng/14.0, 14.0-RELEASE-p6)
2024-02-17 13:45:44 UTC (stable/13, 13.2-STABLE)
2024-03-28 05:07:55 UTC (releng/13.2, 13.2-RELEASE-p11)
CVE Name: CVE-2023-50387, CVE-2023-50868
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
Unbound is a validating, recursive, and caching DNS resolver.
II. Problem Description
The KeyTrap vulnerability (CVE-2023-50387) works by using a co
Ubuntu
Unbound vulnerabilities
vendor_ubuntu·2024-02-28·CVSS 7.5
CVE-2023-50868 [HIGH] Unbound vulnerabilities
Title: Unbound vulnerabilities
Summary: Several security issues were fixed in Unbound.
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service.
(CVE-2023-50868)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2024-02-26·CVSS 7.5
CVE-2023-50387 [HIGH] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)
It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP
packet size as required by DNS Flag Day 2020. This issue only affected
Ubuntu 23.10. (CVE-2023-28450)
Instructions: This update uses a n
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2024-02-19·CVSS 7.5
CVE-2023-50868 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered
that Bind incorrectly handled parsing large DNS messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-4408)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading
Microsoft
MITRE: CVE-2023-50387 DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers
vendor_msrc·2024-02-13·CVSS 7.5
CVE-2023-50387 [HIGH] MITRE: CVE-2023-50387 DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers
MITRE: CVE-2023-50387 DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers
Role: DNS Server: Role: DNS Server
MITRE: MITRE
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034768
Reference: https://support.microsoft.com/help/5034768
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034770
Reference: https://support.microsoft.com/help/5034770
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034769
Reference: https://support.microsoft.com/help/5034769
Reference: https://catalog.update.microsoft.com/v7/site
BSD
OpenBSD 7.3 Errata 026: SECURITY FIX
bsd_advisories·2024-02-13·CVSS 7.5
CVE-2023-50387 [HIGH] OpenBSD 7.3 Errata 026: SECURITY FIX
OpenBSD 7.3 Errata 026: SECURITY FIX
026: SECURITY FIX: February 13, 2024
All architectures DNSSEC protocol vulnerabilities have been discovered that render various DNSSEC validators victims of Denial Of Service while trying to validate specially crafted DNSSEC responses. Fix CVE-2023-50387 and CVE-2023-50868 in unwind(8) and unbound(8).
BSD
OpenBSD 7.4 Errata 013: SECURITY FIX
bsd_advisories·2024-02-13·CVSS 7.5
CVE-2023-50387 [HIGH] OpenBSD 7.4 Errata 013: SECURITY FIX
OpenBSD 7.4 Errata 013: SECURITY FIX
013: SECURITY FIX: February 13, 2024
All architectures DNSSEC protocol vulnerabilities have been discovered that render various DNSSEC validators victims of Denial Of Service while trying to validate specially crafted DNSSEC responses. Fix CVE-2023-50387 and CVE-2023-50868 in unwind(8) and unbound(8).
Red Hat
bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
vendor_redhat·2024-02-13·CVSS 7.5
CVE-2023-50387 [HIGH] CWE-400 bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Processing specially crafted responses coming from DNSSEC-signed zones can lead to uncontrolled CPU usage, leading to a Denial of Service in the DNSSEC-validating resolver side.
This vulnerability applies only for systems where DNSSEC validation is enabled.
Statement: This vulnerability in DNSSEC-validating resolv
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2024-02-13·CVSS 7.5
CVE-2023-5517 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered
that Bind incorrectly handled parsing large DNS messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-4408)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading
Debian
CVE-2023-50387: bind9 - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and r...
vendor_debian·2023·CVSS 7.5
CVE-2023-50387 [HIGH] CVE-2023-50387: bind9 - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and r...
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Scope: local
bookworm: resolved (fixed in 1:9.18.24-1)
bullseye: resolved (fixed in 1:9.16.48-1)
forky: resolved (fixed in 1:9.19.21-1)
sid: resolved (fixed in 1:9.19.21-1)
trixie: resolved (fixed in 1:9.19.21-1)
OSV
dnsmasq vulnerabilities
osv·2024-04-24·CVSS 7.5
CVE-2023-50387 [HIGH] dnsmasq vulnerabilities
dnsmasq vulnerabilities
USN-6657-1 fixed several vulnerabilities in Dnsmasq. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)
It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP
packet size as required by DNS
OSV
bind9 vulnerabilities
osv·2024-04-09·CVSS 7.5
CVE-2023-50387 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2023-50868)
OSV
unbound vulnerabilities
osv·2024-02-28·CVSS 7.5
CVE-2023-50387 [HIGH] unbound vulnerabilities
unbound vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service.
(CVE-2023-50868)
OSV
dnsmasq vulnerabilities
osv·2024-02-26·CVSS 7.5
CVE-2023-50387 [HIGH] dnsmasq vulnerabilities
dnsmasq vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)
It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP
packet size as required by DNS Flag Day 2020. This issue only affected
Ubuntu 23.10. (CVE-2023-28450)
OSV
bind9 vulnerabilities
osv·2024-02-19·CVSS 7.5
CVE-2023-4408 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered
that Bind incorrectly handled parsing large DNS messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-4408)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2023-50868)
It was discovered
OSV
CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU
osv·2024-02-14·CVSS 7.5
CVE-2023-50387 [HIGH] CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
GHSA
GHSA-8459-gg55-8qjj: Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via on
ghsa_unreviewed·2024-02-14
CVE-2023-50387 [HIGH] CWE-770 GHSA-8459-gg55-8qjj: Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via on
Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
OSV
bind9 vulnerabilities
osv·2024-02-13·CVSS 7.5
CVE-2023-4408 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered
that Bind incorrectly handled parsing large DNS messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-4408)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2023-50868)
It was discovered
Suricata
ET HUNTING - DNS Response containing multiple DNSSEC RRSIG Entries (Algorithm 14) - Possible CVE-2023-50387 Activity
suricata·2024-02-20·CVSS 7.5
CVE-2023-50387 [HIGH] ET HUNTING - DNS Response containing multiple DNSSEC RRSIG Entries (Algorithm 14) - Possible CVE-2023-50387 Activity
ET HUNTING - DNS Response containing multiple DNSSEC RRSIG Entries (Algorithm 14) - Possible CVE-2023-50387 Activity
Rule: alert tcp any 53 -> $HOME_NET any (msg:"ET HUNTING - DNS Response containing multiple DNSSEC RRSIG Entries (Algorithm 14) - Possible CVE-2023-50387 Activity"; content:"|84 90|"; offset:4; content:"|00 2e 00 01|"; fast_pattern; content:"|0e|"; distance:8; within:9; content:"|00 2e 00 01|"; distance:0; content:"|0e|"; distance:8; within:9; content:"|00 2e 00 01|"; distance:0; content:"|0e|"; distance:8; within:9; content:"|00 2e 00 01|"; distance:0; content:"|0e|"; distance:8; within:9; reference:cve,2023-50387; reference:url,github.com/knqyf263/CVE-2023-50387; classtype:denial-of-service; sid:2050979; rev:1; metadata:affected_product Any, attack_target DNS_Server, crea
No public exploits indexed.
Bleepingcomputer
KeyTrap attack: Internet access disrupted with one DNS packet
blogs_bleepingcomputer·2024-02-17·CVSS 7.5
CVE-2023-50387 [HIGH] KeyTrap attack: Internet access disrupted with one DNS packet
## KeyTrap attack: Internet access disrupted with one DNS packet
## Bill Toulas
A serious vulnerability named KeyTrap in the Domain Name System Security Extensions (DNSSEC) feature could be exploited to deny internet access to applications for an extended period.
Tracked as CVE-2023-50387, KeyTrap is a design issue in DNSSEC and impacts all popular Domain Name System (DNS) implementations or services.
It allows a remote attacker to cause a long lasting denial-of-service (DoS) condition in vulnerable resolvers by sending a single DNS packet.
DNS is what allows us humans to access online locations by typing in domain names instead of the server's IP address our computer needs to connect to.
DNSSEC is a feature of the DNS that brings cryptographic signatures to DNS records, thus providi
Bleepingcomputer
Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws
blogs_bleepingcomputer·2024-02-13·CVSS 7.6
[HIGH] Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws
## Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws
## Lawrence Abrams
16 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
30 Remote Code Execution Vulnerabilities
5 Information Disclosure Vulnerabilities
9 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities
The total count of 73 flaws does not include 6 Microsoft Edge flaws fixed on February 8th and 1 Mariner flaw.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5034765 cumulative update and the Windows 10 KB5034763 update .
## Two zero-days fixed
This month's Patch Tuesday fixes two actively exploited zero-day vulnerabilities, which Microsoft classifies as a flaw that is publicly disclosed or ac
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12·CVSS 7.5
[HIGH] The February 2024 Security Update Review
## The February 2024 Security Update Review
Get the Feburary 2024 security update and review.
By: Dustin Childs 2024/02/12 Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Important
8.
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12
The February 2024 Security Update Review
# The February 2024 Security Update Review
Get the Feburary 2024 security update and review.
By: Dustin Childs
2024/02/12
Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
Adobe Patches for February 2024
For February, Adobe released six patches addressing 29 CVEs in Adobe Acrobat and Reader, Commerce, Substance 3D
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12·CVSS 7.5
[HIGH] The February 2024 Security Update Review
## The February 2024 Security Update Review
Get the Feburary 2024 security update and review.
By: Dustin Childs Feb 12, 2024 Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Important
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12·CVSS 7.5
[HIGH] The February 2024 Security Update Review
## The February 2024 Security Update Review
Get the February 2024 security update and review.
By: Dustin Childs Feb 12, 2024 Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Important
Huntress
CVE-2023-50387 Vulnerability: Analysis, Detection, Removal | Huntress
blogs_huntress·CVSS 7.5
CVE-2023-50387 [HIGH] CVE-2023-50387 Vulnerability: Analysis, Detection, Removal | Huntress
## CVE-2023-50387 Vulnerability
Published: 12/16/2025
Written by: Lizzie Danielson
## What is CVE-2023-50387 Vulnerability?
CVE-2023-50387, known as KeyTrap, is a Denial-of-Service (DoS) vulnerability discovered within DNSSEC-validating DNS resolvers, including BIND, Unbound, and other recursive resolver implementations. It allows attackers to exhaust system resources by exploiting a flaw in the way DNSSEC signatures are validated within the DNSKEY and RRSIG record processing logic. By crafting maliciously complex DNS responses, attackers can force affected resolvers to perform excessive cryptographic operations, causing CPU exhaustion and rendering the resolver unresponsive.
This vulnerability is tracked under the Common Vulnerabilities and Exposures program and presents significant
arXiv
The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
arxiv_cs_cr·2024-06-05·CVSS 7.5
[HIGH] The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
Availability is a major concern in the design of DNSSEC. To ensure availability, DNSSEC follows Postel's Law [RFC1123]: "Be liberal in what you accept, and conservative in what you send." Hence, nameservers should send not just one matching key for a record set, but all the relevant cryptographic material, e.g., all the keys for all the ciphers that they support and all the corresponding signatures. This ensures that validation succeeds, and hence availability, even if some of the DNSSEC keys are misconfigured, incorrect or correspond to unsupported ciphers.
We show that this design of DNSSEC is flawed. Exploiting vulnerable recommendations in the DNSSEC standards, we develop a
arXiv
The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
arxiv_fulltext·2024-06-05·CVSS 7.5
[HIGH] The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
The Harder You Try, The Harder You Fail:\ KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
Elias Heftrig, Haya Schulmann, Niklas Vogel, Michael Waidner
## Abstract
Availability is a major concern in the design of DNSSEC. To ensure availability, DNSSEC follows Postel's Law [RFC1123]: "Be liberal in what you accept, and conservative in what you send."
Hence, nameservers should send not just one matching key for a record set, but all the relevant cryptographic material, e.g., all the keys for all the ciphers that they support and all the corresponding signatures. This ensures that validation succeeds, and hence availability, even if some of the DNSSEC keys are misconfigured, incorrect or correspond to unsupported ciphers.
We show that this design of DNSSEC is flawed. Expl
http://www.openwall.com/lists/oss-security/2024/02/16/2http://www.openwall.com/lists/oss-security/2024/02/16/3https://access.redhat.com/security/cve/CVE-2023-50387https://bugzilla.suse.com/show_bug.cgi?id=1219823https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.htmlhttps://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1https://kb.isc.org/docs/cve-2023-50387https://lists.debian.org/debian-lts-announce/2024/02/msg00006.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00011.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.htmlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387https://news.ycombinator.com/item?id=39367411https://news.ycombinator.com/item?id=39372384https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/https://security.netapp.com/advisory/ntap-20240307-0007/https://www.athene-center.de/aktuelles/key-traphttps://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdfhttps://www.isc.org/blogs/2024-bind-security-release/https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/http://www.openwall.com/lists/oss-security/2024/02/16/2http://www.openwall.com/lists/oss-security/2024/02/16/3https://access.redhat.com/security/cve/CVE-2023-50387https://bugzilla.suse.com/show_bug.cgi?id=1219823https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.htmlhttps://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1https://kb.isc.org/docs/cve-2023-50387https://lists.debian.org/debian-lts-announce/2024/02/msg00006.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2024/09/msg00001.htmlhttps://lists.debian.org/debian-lts-announce/2024/11/msg00035.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/https://lists.fedoraproject.org/archives/list/[email protected]/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/https://lists.fedoraproject.org/archives/list/[email protected]/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/https://lists.fedoraproject.org/archives/list/[email protected]/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.htmlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387https://news.ycombinator.com/item?id=39367411https://news.ycombinator.com/item?id=39372384https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/https://security.netapp.com/advisory/ntap-20240307-0007/https://www.athene-center.de/aktuelles/key-traphttps://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdfhttps://www.isc.org/blogs/2024-bind-security-release/https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
2024-02-14
Published