The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0043 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain     Name System (DNS) protocols. BIND includes a DNS server (named); a resolver     library (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating correctly.

    A denial of service flaw was found in the way BIND handled queries for     NSEC3-signed zones. A remote attacker could use this flaw against an     authoritative name server that served NCES3-signed zones by sending a     specially crafted query, which, when processed, would cause named to crash.
    (CVE-2014-0591)

    All bind users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing the     update, the BIND daemon (named) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a DoS vulnerability in bind when handling malformed NSEC3-signed zones. CVE-2014-0591 has been assigned to this issue.

Fixed CVE-2014-0591.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash. (CVE-2014-0591)

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-0043 advisory.

    - Fix CVE-2014-0591
    - fix CVE-2013-4854
    - fix  CVE-2013-2266
    - fix CVE-2012-5689

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash. (CVE-2014-0591)

- Update to version 9.9.4P2

  - Fixes named crash when handling malformed NSEC3-signed     zones (CVE-2014-0591, bnc#858639)

  - Obsoletes workaround-compile-problem.diff

  - Replace rpz2+rl-9.9.3-P1.patch by rpz2-9.9.4.patch, rl     is now supported upstream (--enable-rrl).

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     constructed a response to a query that met certain     criteria. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure via a     specially crafted DNS request packet.(CVE-2016-2776)

  - A denial of service flaw was found in the way BIND     processed certain control channel input. A remote     attacker able to send a malformed packet to the control     channel could use this flaw to cause named to     crash.(CVE-2016-1285)

  - A flaw was found in the way BIND performed DNSSEC     validation. An attacker able to make BIND (functioning     as a DNS resolver with DNSSEC validation enabled)     resolve a name in an attacker-controlled domain could     cause named to exit unexpectedly with an assertion     failure.(CVE-2015-4620)

  - A flaw was found in the way BIND handled requests for     TKEY DNS resource records. A remote attacker could use     this flaw to make named (functioning as an     authoritative DNS server or a DNS resolver) exit     unexpectedly with an assertion failure via a specially     crafted DNS request packet.(CVE-2015-5477)

  - A denial of service flaw was found in the way BIND     handled queries for NSEC3-signed zones. A remote     attacker could use this flaw against an authoritative     name server that served NCES3-signed zones by sending a     specially crafted query, which, when processed, would     cause named to crash.(CVE-2014-0591)

  - A denial of service flaw was found in the way BIND     parsed certain malformed DNSSEC keys. A remote attacker     could use this flaw to send a specially crafted DNS     query (for example, a query requiring a response from a     zone containing a deliberately malformed key) that     would cause named functioning as a validating resolver     to crash.(CVE-2015-5722)

  - It was found that the lightweight resolver protocol     implementation in BIND could enter an infinite     recursion and crash when asked to resolve a query name     which, when combined with a search list entry, exceeds     the maximum allowable length. A remote attacker could     use this flaw to crash lwresd or named when using the     'lwres' statement in named.conf.(CVE-2016-2775)

  - A denial of service flaw was found in the way BIND     processed certain records with malformed class     attributes. A remote attacker could use this flaw to     send a query to request a cached record with a     malformed class attribute that would cause named     functioning as an authoritative or recursive server to     crash. Note: This issue affects authoritative servers     as well as recursive servers, however authoritative     servers are at limited risk if they perform     authentication when making recursive queries to resolve     addresses for servers listed in NS     RRSETs.(CVE-2015-8000)

  - A denial of service flaw was found in the way BIND     handled responses containing a DNAME answer. A remote     attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response.(CVE-2016-8864)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response.(CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     followed DNS delegations. A remote attacker could use a     specially crafted zone containing a large number of     referrals which, when looked up and processed, would     cause named to use excessive amounts of memory or     crash.(CVE-2014-8500)

  - A flaw was found in the way BIND handled trust anchor     management. A remote attacker could use this flaw to     cause the BIND daemon (named) to crash under certain     conditions.(CVE-2015-1349)

  - A denial of service flaw was found in the way BIND     parsed signature records for DNAME records. By sending     a specially crafted query, a remote attacker could use     this flaw to cause named to crash.(CVE-2016-1286)

  - A use-after-free flaw leading to denial of service was     found in the way BIND internally handled cleanup     operations on upstream recursion fetch contexts. A     remote attacker could potentially use this flaw to make     named, acting as a DNSSEC validating resolver, exit     unexpectedly with an assertion failure via a specially     crafted DNS request.(CVE-2017-3145)

  - A denial of service flaw was found in the way BIND     handled query requests when using DNS64 with     'break-dnssec yes' option. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS     request.(CVE-2017-3136)

  - A flaw was found in the way BIND handled TSIG     authentication of AXFR requests. A remote attacker,     able to communicate with an authoritative BIND server,     could use this flaw to view the entire contents of a     zone by sending a specially constructed request     packet.(CVE-2017-3142)

  - A flaw was found in the way BIND handled TSIG     authentication for dynamic updates. A remote attacker     able to communicate with an authoritative BIND server     could use this flaw to manipulate the contents of a     zone, by forging a valid TSIG or SIG(0) signature for a     dynamic update request.(CVE-2017-3143)

  - A denial of service flaw was discovered in bind     versions that include the 'deny-answer-aliases'     feature. This flaw may allow a remote attacker to     trigger an INSIST assert in named leading to     termination of the process and a denial of service     condition.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has bind packages installed that are affected by multiple vulnerabilities:

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

  - BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service     (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.
    (CVE-2006-4095)

  - Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is     enabled, allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries     processed by the query_addsoa function. (CVE-2007-2241)

  - The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set     the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries     and query the cache. (CVE-2007-2925)

  - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when     answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for     remote attackers to guess the next query id and perform DNS cache poisoning. (CVE-2007-2926)

  - Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions,     which allows local users to perform unauthorized named commands, such as causing a denial of service by     stopping named. (CVE-2007-6283)

  - Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in     FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
    (CVE-2008-0122)

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

  - BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL     DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a     malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. (CVE-2009-0025)

  - The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3,     and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of     service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted     dynamic update message, as exploited in the wild in July 2009. (CVE-2009-0696)

  - BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured     statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service     (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to     repeatedly send RRSIG queries to the authoritative servers. (CVE-2010-0213)

  - ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows     remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.
    (CVE-2011-1907)

  - Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before     9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service     (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets. (CVE-2011-1910)

  - query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0     through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial     of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error     logging, and the caching of an invalid record by the resolver. (CVE-2011-4313)

  - ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before     9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows     remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive     information from process memory via a crafted record. (CVE-2012-1667)

  - libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3     before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption)     via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running     a named process. (CVE-2013-2266)

  - resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1,     when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion     failure and named daemon exit) via a query for a record in a malformed zone. (CVE-2013-3919)

  - The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before     9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers     to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA     section that is not properly handled during construction of a log message, as exploited in the wild in     July 2013. (CVE-2013-4854)

  - The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and     9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of     service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver     that uses the NSEC3 signing feature. (CVE-2014-0591)

  - A race condition which may occur when discarding malformed packets can result in BIND exiting due to a     REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1,     9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND     9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.
    (CVE-2019-6471)

  - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches     performed when processing referrals can, through the use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an attempt to process the referral. This has at least     two potential effects: The performance of the recursing server can potentially be degraded by the     additional work required to perform these fetches, and The attacker can exploit this behavior to use the     recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

  - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the     server. Since BIND, by default, configures a local session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating     from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately     exits. Prior to the introduction of the check the server would continue operating in an inconsistent     state, with potentially harmful results. (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Mac OS X host has a version of OS X Server installed that is prior to version 4.0.  It is, therefore, affected by the following vulnerabilities :

  - There are multiple vulnerabilities within the included     BIND, the most serious of which can lead to a denial of     service. (CVE-2013-3919, CVE-2013-4854, CVE-2014-0591)

  - There are multiple vulnerabilities within the included     LibYAML for the Profile Manager and ServerRuby, the most     serious of which can lead to arbitrary code execution.
    (CVE-2013-4164, CVE-2013-6393)

  - There are multiple vulnerabilities within the included     PostgreSQL, the most serious of which can lead to     arbitrary code execution. (CVE-2014-0060, CVE-2014-0061,     CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,     CVE-2014-0065, CVE-2014-0066)

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566)

  - A cross-site scripting flaw exists in the Xcode Server     due to not properly validating input before returning it     to the user. This can allow a remote attacker, using a     specially crafted request, to execute code within the     browser / server trust relationship. (CVE-2014-4406)

  - A SQL injection flaw exists in the Wiki Server due to     not properly sanitizing user input before using it in     SQL queries. This can allow a remote attacker, using a     specially crafted request, to inject or manipulate SQL     queries, thus allowing the manipulation or disclosure     of arbitrary data. (CVE-2014-4424)

  - A restriction bypass flaw exists in the Mail Server due     to SCAL changes being cached and not enforced until the     service had restarted. This can allow an authenticated     remote attacker to bypass those restrictions.
    (CVE-2014-4446)

  - A password disclosure flaw exists in the Profile Manager     due to passwords being potentially saved to a file when     editing or setting up a profile. This can allow a local     attacker to gain access to password information.
    (CVE-2014-4447)

A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash. (CVE-2014-0591)

After installing the update, the BIND daemon (named) will be restarted automatically.

Jared Mauch reported a denial of service flaw in the way BIND, a DNS server, handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash.

Updated bind97 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. It contains a DNS server (named), a resolver library with routines for applications to use when interfacing with DNS, and tools for verifying that the DNS server is operating correctly. These packages contain version 9.7 of the BIND suite.

A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash. (CVE-2014-0591)

Note: The CVE-2014-0591 issue does not directly affect the version of bind97 shipped in Red Hat Enterprise Linux 5. This issue is being addressed however to assure it is not introduced in future builds of bind97 (possibly built with a different compiler or C library optimization).

This update also fixes the following bug :

* Previously, the bind97 initscript did not check for the existence of the ROOTDIR variable when shutting down the named daemon. As a consequence, some parts of the file system that are mounted when using bind97 in a chroot environment were unmounted on daemon shut down, even if bind97 was not running in a chroot environment. With this update, the initscript has been fixed to check for the existence of the ROOTDIR variable when unmounting some parts of the file system on named daemon shut down. Now, when shutting down bind97 that is not running in a chroot environment, no parts of the file system are unmounted. (BZ#1059118)

All bind97 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, the BIND daemon (named) will be restarted automatically.

Fix denial of service attack when processing NSEC3-signed zone queries, fixed by not calling memcpy with overlapping ranges in bin/named/query.c. - patch backported from 9.8.6-P2 by Marc Deslauriers from the Ubuntu Security team for USN-2081-1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-8500 (#1171973)

  - Use /dev/urandom when generating rndc.key file (#951255)

  - Remove bogus file from /usr/share/doc, introduced by fix     for bug #1092035

  - Add support for TLSA resource records (#956685)

  - Increase defaults for lwresd workers and make workers     and client objects number configurable (#1092035)

  - Fix segmentation fault in nsupdate when -r option is     used (#1064045)

  - Fix race condition on send buffer in host tool when     sending UDP query (#1008827)

  - Allow authentication using TSIG in allow-notify     configuration statement (#1044545)

  - Fix SELinux context of /var/named/chroot/etc/localtime     (#902431)

  - Include updated named.ca file with root server addresses     (#917356)

  - Don't generate rndc.key if there is rndc.conf on     start-up (#997743)

  - Fix dig man page regarding how to disable IDN (#1023045)

  - Handle ICMP Destination unreachable (Protocol     unreachable) response (#1066876)

  - Configure BIND with --with-dlopen=yes to support     dynamically loadable DLZ drivers (#846065)

  - Fix initscript to return correct exit value when calling     checkconfig/configtest/check/test (#848033)

  - Don't (un)mount chroot filesystem when running     initscript command configtest with running server     (#851123)

  - Fix zone2sqlite tool to accept zones containing '.' or     '-' or starting with a digit (#919414)

  - Fix initscript not to mount chroot filesystem is named     is already running (#948743)

  - Fix initscript to check if the PID in PID-file is really     s PID of running named server (#980632)

  - Correct the installed documentation ownership (#1051283)

  - configure with --enable-filter-aaaa to enable use of     filter-aaaa-on-v4 option (#1025008)

  - Fix race condition when destroying a resolver fetch     object (#993612)

  - Fix the RRL functionality to include     referrals-per-second and nodata-per-second options     (#1036700)

  - Fix segfault on SERVFAIL to NXDOMAIN failover (#919545)

  - Fix (CVE-2014-0591)

  - Fix gssapictx memory leak (#911167)

  - fix (CVE-2013-4854)

  - fix (CVE-2013-2266)

  - ship dns/rrl.h in -devel subpkg

  - remove one bogus file from /usr/share/doc, introduced by     RRL patch

  - fix (CVE-2012-5689)

  - add response rate limit patch (#873624)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
72059	RHEL 6 : bind (RHSA-2014:0043)	Nessus	Red Hat Local Security Checks	2014/1/21	2024/11/4	high
72241	SuSE 11.2 / 11.3 Security Update : bind (SAT Patch Numbers 8834 / 8835)	Nessus	SuSE Local Security Checks	2014/2/1	2021/1/19	low
72014	Fedora 20 : bind-9.9.4-11.P2.fc20 (2014-0811)	Nessus	Fedora Local Security Checks	2014/1/20	2021/1/11	low
72044	CentOS 6 : bind (CESA-2014:0043)	Nessus	CentOS Local Security Checks	2014/1/21	2021/1/4	low
72057	Oracle Linux 6 : bind (ELSA-2014-0043)	Nessus	Oracle Linux Local Security Checks	2014/1/21	2024/10/22	high
72305	Amazon Linux AMI : bind (ALAS-2014-287)	Nessus	Amazon Linux Local Security Checks	2014/2/5	2018/4/18	low
75248	openSUSE Security Update : bind (openSUSE-SU-2014:0199-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	low
124936	EulerOS Virtualization 3.0.1.0 : bind (EulerOS-SA-2019-1433)	Nessus	Huawei Local Security Checks	2019/5/14	2025/11/20	medium
147379	NewStart CGSL CORE 5.04 / MAIN 5.04 : bind Multiple Vulnerabilities (NS-SA-2021-0017)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/5/10	medium
78601	Mac OS X : OS X Server < 4.0 Multiple Vulnerabilities (POODLE)	Nessus	MacOS X Local Security Checks	2014/10/21	2023/6/23	medium
72084	Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20140120)	Nessus	Scientific Linux Local Security Checks	2014/1/22	2021/1/14	low
77637	Debian DSA-3023-1 : bind9 - security update	Nessus	Debian Local Security Checks	2014/9/12	2021/1/11	low
77991	CentOS 5 : bind97 (CESA-2014:1244)	Nessus	CentOS Local Security Checks	2014/10/1	2021/1/4	low
82195	Debian DLA-48-1 : bind9 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	low
80247	OracleVM 3.3 : bind (OVMSA-2014-0084)	Nessus	OracleVM Local Security Checks	2014/12/26	2021/1/4	high

检测

插件搜索

high

low

low

low

high

low

low

medium

medium

medium

low

low

low

low

high