CVE catalog

CVE-2023-3341

bind9: CVE-2023-3341

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.96% · Oct 25, 2026

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbind9sid1:9.20.30-1fixed
Debianbind9forky1:9.20.30-1fixed
Debianbind9trixie1:9.20.26-1~deb13u1fixed
Debianbind9trixie-security1:9.20.30-1~deb13u1fixed
Debianbind9bookworm1:9.18.49-1~deb12u1fixed
Debianbind9bookworm-security1:9.18.49-1~deb12u3fixed
Alpinebind3.159.16.44-r0fixed
Alpinebind3.169.16.44-r0fixed
Alpinebind3.179.18.19-r0fixed
Alpinebind3.189.18.19-r0fixed
Alpinebind3.199.18.19-r0fixed
Alpinebind3.209.18.19-r0fixed
Alpinebind3.219.18.19-r0fixed
Alpinebind3.229.18.19-r0fixed
Alpinebind3.239.18.19-r0fixed
Alpinebind3.249.18.19-r0fixed
Ubuntubind9pro1:9.10.3.dfsg.P4-12.6ubuntu1vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu2vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu3vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu4vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu5vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.1vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.2vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.3vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.5vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.7vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.8vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.9vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.10vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.11vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.12vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.13vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.14vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.15vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.16vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.17vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.18vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.19+esm1vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.19+esm2fixed
Ubuntubind9pro1:9.10.3.dfsg.P4-12.6ubuntu1vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu2vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu3vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu4vulnerable
Ubuntubind9pro1:9.11.2.P1-1ubuntu5vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.1vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.2vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.3vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.5vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.7vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.8vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.9vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.10vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.11vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.12vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.13vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.14vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.15vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.16vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.17vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.18vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.19+esm1vulnerable
Ubuntubind9pro1:9.11.3+dfsg-1ubuntu1.19+esm2fixed
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu2vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu3vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu4vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu5vulnerable
Ubuntubind920.041:9.11.14+dfsg-1ubuntu1vulnerable
Ubuntubind920.041:9.11.14+dfsg-3ubuntu1vulnerable
Ubuntubind920.041:9.16.0-1ubuntu3vulnerable
Ubuntubind920.041:9.16.0-1ubuntu4vulnerable
Ubuntubind920.041:9.16.0-1ubuntu5vulnerable
Ubuntubind920.041:9.16.1-0ubuntu1vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.1vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.2vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.3vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.4vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.6vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.7vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.8vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.9vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.10vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.11vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.12vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.14vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.15vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.16fixed
Ubuntubind922.041:9.16.15-1ubuntu1vulnerable
Ubuntubind922.041:9.16.15-1ubuntu2vulnerable
Ubuntubind922.041:9.16.15-1ubuntu3vulnerable
Ubuntubind922.041:9.18.0-2ubuntu1vulnerable
Ubuntubind922.041:9.18.0-2ubuntu2vulnerable
Ubuntubind922.041:9.18.0-2ubuntu3vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.1vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.2vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.3vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.2vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.3fixed
Ubuntubind924.041:9.18.18-0ubuntu2fixed
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu2vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu3vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu4vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu5vulnerable
Ubuntubind920.041:9.11.14+dfsg-1ubuntu1vulnerable
Ubuntubind920.041:9.11.14+dfsg-3ubuntu1vulnerable
Ubuntubind920.041:9.16.0-1ubuntu3vulnerable
Ubuntubind920.041:9.16.0-1ubuntu4vulnerable
Ubuntubind920.041:9.16.0-1ubuntu5vulnerable
Ubuntubind920.041:9.16.1-0ubuntu1vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.1vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.2vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.3vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.4vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.6vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.7vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.8vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.9vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.10vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.11vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.12vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.14vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.15vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.16fixed
Ubuntubind922.041:9.16.15-1ubuntu1vulnerable
Ubuntubind922.041:9.16.15-1ubuntu2vulnerable
Ubuntubind922.041:9.16.15-1ubuntu3vulnerable
Ubuntubind922.041:9.18.0-2ubuntu1vulnerable
Ubuntubind922.041:9.18.0-2ubuntu2vulnerable
Ubuntubind922.041:9.18.0-2ubuntu3vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.1vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.2vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.3vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.2vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.3fixed
Susebindmanager client tools for sle micro 59.16.6-150000.12.71.1fixed
Susebindlinux enterprise high performance computing 15 sp1-ltss9.16.6-150000.12.71.1fixed
Susebindlinux enterprise high performance computing 15 sp2-ltss9.16.6-150000.12.71.1fixed
Susebindlinux enterprise server 15 sp1-ltss9.16.6-150000.12.71.1fixed
Susebindlinux enterprise server 15 sp2-ltss9.16.6-150000.12.71.1fixed
Susebindlinux enterprise server for sap applications 15 sp19.16.6-150000.12.71.1fixed
Susebindlinux enterprise server for sap applications 15 sp29.16.6-150000.12.71.1fixed
Opensusebindleap 15.49.16.6-150000.12.71.1fixed
Susebindlinux enterprise software development kit 12 sp59.11.22-3.49.1fixed
Susebindlinux enterprise server 12 sp59.11.22-3.49.1fixed
Susebindlinux enterprise server for sap applications 12 sp59.11.22-3.49.1fixed
Susebindlinux enterprise high performance computing 15 sp3-espos9.16.6-150300.22.41.1fixed
Susebindlinux enterprise high performance computing 15 sp3-ltss9.16.6-150300.22.41.1fixed
Susebindlinux enterprise server 15 sp3-ltss9.16.6-150300.22.41.1fixed
Susebindlinux enterprise server for sap applications 15 sp39.16.6-150300.22.41.1fixed
Susebindmanager proxy 4.29.16.6-150300.22.41.1fixed
Susebindmanager server 4.29.16.6-150300.22.41.1fixed
Susebindenterprise storage 7.19.16.6-150300.22.41.1fixed
Opensusebindtumbleweed9.18.19-1.1fixed
Susebindlinux enterprise module for basesystem 15 sp49.16.44-150400.5.37.2fixed
Susebindlinux enterprise module for server applications 15 sp49.16.44-150400.5.37.2fixed
Opensusebindleap 15.49.16.44-150400.5.37.2fixed
Susebindlinux enterprise module for basesystem 15 sp59.16.44-150500.8.12.2fixed
Susebindlinux enterprise module for server applications 15 sp59.16.44-150500.8.12.2fixed
Opensusebindleap 15.59.16.44-150500.8.12.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbind9sourcesid1:9.19.17-1not yet assignedNot reported[1052416]
Debianbind9sourceforky1:9.19.17-1not yet assignedNot reported[1052416]
Debianbind9sourcetrixie1:9.19.17-1not yet assignedNot reported[1052416]
Debianbind9sourcebookworm1:9.18.19-1~deb12u1not yet assignedNot reported[1052416]
Alpinebindapk3.159.16.44-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.169.16.44-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.179.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.189.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.199.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.209.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.219.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.229.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.239.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Alpinebindapk3.249.18.19-r0Not reportedALPINE-CVE-2023-3341Not reported
Ubuntubind9debpro1:9.11.3+dfsg-1ubuntu1.19+esm2Not reportedUSN-6421-1Not reported
Ubuntubind9debpro1:9.11.3+dfsg-1ubuntu1.19+esm2Not reportedUBUNTU-CVE-2023-3341Not reported
Ubuntubind9deb20.041:9.16.1-0ubuntu2.16Not reportedUBUNTU-CVE-2023-3341Not reported
Ubuntubind9deb22.041:9.18.12-0ubuntu0.22.04.3Not reportedUBUNTU-CVE-2023-3341Not reported
Ubuntubind9deb24.041:9.18.18-0ubuntu2Not reportedUBUNTU-CVE-2023-3341Not reported
Ubuntubind9deb20.041:9.16.1-0ubuntu2.16Not reportedUSN-6390-1Not reported
Ubuntubind9deb22.041:9.18.12-0ubuntu0.22.04.3Not reportedUSN-6390-1Not reported
Susebindrpmmanager client tools for sle micro 59.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp1-ltss9.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp2-ltss9.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise server 15 sp1-ltss9.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise server 15 sp2-ltss9.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise server for sap applications 15 sp19.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise server for sap applications 15 sp29.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Opensusebindrpmleap 15.49.16.6-150000.12.71.1Not reportedSUSE-SU-2023:3805-1Not reported
Susebindrpmlinux enterprise software development kit 12 sp59.11.22-3.49.1Not reportedSUSE-SU-2023:3796-1Not reported
Susebindrpmlinux enterprise server 12 sp59.11.22-3.49.1Not reportedSUSE-SU-2023:3796-1Not reported
Susebindrpmlinux enterprise server for sap applications 12 sp59.11.22-3.49.1Not reportedSUSE-SU-2023:3796-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp3-espos9.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp3-ltss9.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Susebindrpmlinux enterprise server 15 sp3-ltss9.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Susebindrpmlinux enterprise server for sap applications 15 sp39.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Susebindrpmmanager proxy 4.29.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Susebindrpmmanager server 4.29.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Susebindrpmenterprise storage 7.19.16.6-150300.22.41.1Not reportedSUSE-SU-2023:3934-1Not reported
Opensusebindrpmtumbleweed9.18.19-1.1Not reportedOPENSUSE-SU-2024:13249-1Not reported
Susebindrpmlinux enterprise module for basesystem 15 sp49.16.44-150400.5.37.2Not reportedSUSE-SU-2023:3737-1Not reported
Susebindrpmlinux enterprise module for server applications 15 sp49.16.44-150400.5.37.2Not reportedSUSE-SU-2023:3737-1Not reported
Opensusebindrpmleap 15.49.16.44-150400.5.37.2Not reportedSUSE-SU-2023:3737-1Not reported
Susebindrpmlinux enterprise module for basesystem 15 sp59.16.44-150500.8.12.2Not reportedSUSE-SU-2023:3821-1Not reported
Susebindrpmlinux enterprise module for server applications 15 sp59.16.44-150500.8.12.2Not reportedSUSE-SU-2023:3821-1Not reported
Opensusebindrpmleap 15.59.16.44-150500.8.12.2Not reportedSUSE-SU-2023:3821-1Not reported

[Debian bug #1052416]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References