ISC reports :

A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.

Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers.
DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.

An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.

Security fix for CVE-2016-9131, CVE-2016-9147, CVE-2016-9444

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     handled query responses when both DNS64 and RPZ were     used. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure or a     null pointer dereference via a specially crafted DNS     response. (CVE-2017-3135)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response. (CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     handled a query response containing inconsistent DNSSEC     information. A remote attacker could use this flaw to     make named exit unexpectedly with an assertion failure     via a specially crafted DNS response. (CVE-2016-9147)

  - A denial of service flaw was found in the way BIND     handled an unusually-formed DS record response. A     remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response. (CVE-2016-9444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for bind is now available for Red Hat Enterprise Linux 7.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-8864)

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

* A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3137)

Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Tony Finch (University of Cambridge) and Marco Davids (SIDN Labs) as the original reporters of CVE-2016-8864.

Bug Fix(es) :

* ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017. Maintaining an up-to-date KSK is essential for ensuring that validating DNS resolvers continue to function following the rollover. (BZ#1459648)

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

Red Hat would like to thank ISC for reporting these issues.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

9.9.9-P5より前の9.x、9.10.4-P5より前の9.10.x、9.11.0-P2より前の9.11.xのISC BINDにおけるnamedにより、リモートの攻撃者が応答内の細工されたDSリソースレコードを介して、サービス拒否（アサーション失敗とデーモン終了）を引き起こすことができます。（CVE-2016-9444）影響：BIND再帰オプションが有効な場合、攻撃者がこの脆弱性を悪用し、指定されたプロセスを再起動させる可能性があります。また、再起動されたプロセスが、BIG-IPシステムの高可用性（HA）フェールオーバーイベントをトリガーしません。デフォルトでは、BIG-IP DNSシステムまたはGTMシステムでは、BIND再帰オプションは有効になっていません。BIND再帰オプションが有効になっている場合、BIG-IP DNSシステムまたはGTMシステムは脆弱です。

bind 用のこの更新は、次の問題を修正します：

  -ANYクエリに対する無効な形式の応答によって引き起こされる可能性があるアサーションの失敗の可能性を修正します。この失敗により、サービス拒否攻撃が容易になります。
    [CVE-2016-9131、bsc#1018700、bsc#1018699]

  -ANYクエリに対する無効な形式の応答によって引き起こされる可能性があるアサーションの失敗の可能性を修正します。この失敗により、サービス拒否攻撃が容易になります。[[CVE-2016-9147、bsc#1018701、bsc#1018699]

  -ANYクエリに対する無効な形式の応答によって引き起こされる可能性があるアサーションの失敗の可能性を修正します。[CVE-2016-9444このbsc#1018702失敗bsc#1018699により、サービス拒否攻撃が容易になります。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

DNS サーバーの実装である BIND でサービスの拒否 (アサーションの失敗) 脆弱性が発見されました。- CVE-2016-9131     ANY クエリに対する細工されたアップストリームレスポンスにより、     アサーション失敗が発生する可能性があります。- CVE-2016-9147     自己矛盾する DNSSEC データを含んでいる細工されたアップストリームレスポンスにより、     アサーション失敗が発生する可能性があります。- CVE-2016-9444     DS レコードを含んでいる特別に細工されたアップストリームレスポンス     アサーション失敗が発生する可能性があります。主に、再帰的なサービスを提供する DNS サーバーがこれらの脆弱性の影響を受けます。権威サーバーのみに対するクライアントのクエリでは、これらのアサーション失敗がトリガーされません。これらの脆弱性は、サーバー構成で DNSSEC 検証が有効になっているかどうかにかかわらず存在します。

bind 用のこの更新は、次の問題を修正します：

  -ANYクエリに対する無効な形式の応答によって引き起こされる可能性があるアサーションの失敗の可能性を修正します。この失敗により、サービス拒否攻撃が容易になります。
    [CVE-2016-9131、bsc#1018700、bsc#1018699]

  -ANYクエリに対する無効な形式の応答によって引き起こされる可能性があるアサーションの失敗の可能性を修正します。この失敗により、サービス拒否攻撃が容易になります。[[CVE-2016-9147、bsc#1018701、bsc#1018699]

  -ANYクエリに対する無効な形式の応答によって引き起こされる可能性があるアサーションの失敗の可能性を修正します。[CVE-2016-9444このbsc#1018702失敗bsc#1018699により、サービス拒否攻撃が容易になります。

This update was imported from the SUSE: SLE-12-SP1：Update update project.

自己報告されたバージョン番号によると、リモートネームサーバーで実行されているISC BIND 9のインスタンスは、9.9.9-P5または9.9.9-S7より前の9.9.x、9.10.4-P5より前の9.10.x、または9.11.0-P2より前の9.11.xです。したがって、複数のサービス拒否の脆弱性による影響を受けます。RTYPE ANYクエリへの応答にある特別に細工された応答パケットの処理の際にトリガーされる欠陥により、サービス拒否の脆弱性がnamedにあります。認証されていないリモートの攻撃者がこれを悪用して、アサーションの失敗やデーモンの終了を引き起こす可能性があります。この脆弱性の影響を受けるのは、バージョン9.4.0～9.6-ESV-R11-W1、9.8.5～9.8.8、9.9.3～9.9.9-P4、9.9.9-S1～9.9.9-S6、9.10.0～9.10.4-P4、9.11.0～9.11.0-P1です。（CVE-2016-9131）- 一貫性のないDNSSEC情報を含むクエリ応答の処理の際にトリガーされる、DNSSEC対応の権限のあるサーバーのnamedに、サービス拒否の脆弱性があります。認証されていないリモートの攻撃者がこれを悪用して、アサーションの失敗やデーモンの終了を引き起こす可能性があります。この脆弱性の影響を受けるのは、9.9.9-P4、9.9.9-S6、9.10.4-P4、9.11.0-P1のバージョンです。（CVE-2016-9147）- DSリソースレコードを含む特別に細工された応答の処理の際にトリガーされる欠陥により、サービス拒否の脆弱性がnamedにあります。認証されていないリモートの攻撃者がこれを悪用して、アサーションの失敗やデーモンの終了を引き起こす可能性があります。この脆弱性の影響を受けるのは、バージョン9.6-ESV-R9～9.6-ESV-R11-W1、9.8.5～9.8.8、9.9.3～9.9.9-P4、9.9.9-S1～9.9.9-S6、9.10.0～9.10.4-P4、9.11.0～9.11.0-P1です。（CVE-2016-9444）- 特別に細工されたクエリを処理するときにトリガーされるnxdomain-redirect機能のnamedにサービス拒否の脆弱性があります。認証されていないリモートの攻撃者がこれを悪用して、REQUIREアサーションの失敗およびデーモンの終了を引き起こす可能性があります。この脆弱性の影響を受けるのは、9.9.8-S1～9.9.8-S3、9.9.9-S1～9.9.9-S6、9.11.0-9.11.0～P1のバージョンです。（CVE-2016-9778）Nessusはこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

  - Fixed ldapdump to use a temporary pseudo nameserver that     conforms to BIND's expected syntax. Prior versions would     not work correctly with an LDAP backed DNS server.
    [bsc#965748]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3172-1 advisory.

    It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2016-9131)

    It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2016-9147)

    It was discovered that Bind incorrectly handled certain malformed DS record responses. A remote attacker     could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9444)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly with     an assertion failure via a specially crafted DNS     response. (CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     handled a query response containing inconsistent DNSSEC     information. A remote attacker could use this flaw to     make named exit unexpectedly with an assertion failure     via a specially crafted DNS response. (CVE-2016-9147)

  - A denial of service flaw was found in the way BIND     handled an unusually- formed DS record response. A     remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response. (CVE-2016-9444)

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

Red Hat would like to thank ISC for reporting these issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0062 advisory.

    - Fix CVE-2016-9131 (ISC change 4508)
    - Fix CVE-2016-9147 (ISC change 4510)
    - Fix regression introduced by CVE-2016-8864 (ISC change 4530)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96473	FreeBSD : BIND -- multiple vulnerabilities (d4c7e9a9-d893-11e6-9b4d-d050996490d0)	Nessus	FreeBSD Local Security Checks	2017/1/13	2021/1/4	high
96540	Fedora 24 : bind99 (2017-8f23f564ad)	Nessus	Fedora Local Security Checks	2017/1/17	2021/1/6	high
99870	EulerOS 2.0 SP1 : bind (EulerOS-SA-2017-1025)	Nessus	Huawei Local Security Checks	2017/5/1	2021/1/6	high
101100	RHEL 7 : bind (RHSA-2017:1583)	Nessus	Red Hat Local Security Checks	2017/6/29	2019/10/24	high
101407	Virtuozzo 7 : bind / bind-chroot / bind-devel / bind-libs / etc (VZLSA-2017-0062)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2021/1/4	high
96463	F5 Networks BIG-IP：BINDの脆弱性（K40181790）	Nessus	F5 Networks Local Security Checks	2017/1/13	2019/5/9	high
96434	SUSE SLES11セキュリティ更新プログラム：bind（SUSE-SU-2017:0112-1）	Nessus	SuSE Local Security Checks	2017/1/12	2021/1/19	high
96460	Debian DSA-3758-1 : bind9 - セキュリティ更新	Nessus	Debian Local Security Checks	2017/1/13	2021/1/11	high
96621	openSUSEセキュリティ更新プログラム：bind（openSUSE-2017-114）	Nessus	SuSE Local Security Checks	2017/1/19	2021/1/19	high
96625	ISC BIND 9 < 9.9.9-P5/9.9.9-S7/9.10.4-P5/9.11.0-P2の複数のDoS	Nessus	DNS	2017/1/19	2018/12/7	high
96433	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2017:0111-1)	Nessus	SuSE Local Security Checks	2017/1/12	2021/1/6	high
96435	SUSE SLES12 Security Update : bind (SUSE-SU-2017:0113-1)	Nessus	SuSE Local Security Checks	2017/1/12	2021/1/6	high
96483	Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerabilities (USN-3172-1)	Nessus	Ubuntu Local Security Checks	2017/1/13	2025/9/3	high
96508	Fedora 25 : bind99 (2017-f44f2f5a48)	Nessus	Fedora Local Security Checks	2017/1/16	2021/1/6	high
96563	Scientific Linux Security Update : bind on SL7.x x86_64 (20170116)	Nessus	Scientific Linux Local Security Checks	2017/1/17	2021/1/14	high
96567	CentOS 7 : bind (CESA-2017:0062)	Nessus	CentOS Local Security Checks	2017/1/18	2021/1/4	high
96584	Oracle Linux 7 : bind (ELSA-2017-0062)	Nessus	Oracle Linux Local Security Checks	2017/1/18	2024/11/1	high
99871	EulerOS 2.0 SP2 : bind (EulerOS-SA-2017-1026)	Nessus	Huawei Local Security Checks	2017/5/1	2021/1/6	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high