NSEC3 Issue: Remote Denial of Service via DNSSEC Responses
CVE-2023-50868
Key Information:
- Vendor
DNS protocol
- Status
- Vendor
- CVE Published:
- 14 February 2024
Badges
What is CVE-2023-50868?
A vulnerability in the DNS protocol allows remote attackers to significantly consume CPU resources by exploiting the Closest Encloser Proof aspect of DNSSEC responses. This can trigger excessive SHA-1 computations during a random subdomain attack, leading to denial of service conditions. The issue arises when the RFC 5155 specifications are misapplied, demanding thousands of hash iterations in certain scenarios, thereby creating a potential service disruption.
News Articles
Microsoft Late to the Game on Dangerous DNSSEC Zero-Day Flaw
Why the company took so long to address the issue is not known given that most other stakeholders had a fix out for the issue months ago.
SpiceworksJune 2024 Patch Tuesday - Spiceworks
Only one of the 51 patches released by Microsoft on June Patch Tuesday for a publicly known zero-day exploit.
CybersecurityNewsCVE-2023-50868Microsoft Security Update : RCE, Privilege Escalation Flaws Patched
The June 2024 Patch Tuesday update from Microsoft addressed almost 49 vulnerabilities in its products and 9 vulnerabilities in non-Microsoft
References
EPSS Score
41% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit known to exist
- 📰
First article discovered by CrowdStrike
Vulnerability published
Vulnerability Reserved