bind用のこの更新は、次の問題を修正します：

修正されたセキュリティ問題：

CVE-2018-5740：deny-answer-aliases機能でのサービス拒否の脆弱性を修正しました（bsc#1104129）。

CVE-2019-6465：ゾーン転送の制御がDynamically Loadable Zonesに適切に適用されない問題を修正しました（bsc#1126069）。

CVE-2018-5745：トラストアンカーがmanaged-keysの使用時にサポートされていないキーアルゴリズムにロールオーバーした場合のアサーション失敗。
（bsc#1126068）

CVE-2018-5743：同時TCPクライアントを制限しても効果がありません。
（bsc#1133185）

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

bind用のこの更新は、次の問題を修正します：

修正されたセキュリティ問題：

  - CVE-2019-6465：ゾーン転送の制御がDynamically Loadable Zonesに適切に適用されない問題を修正しました（bsc#1126069）。

  - CVE-2018-5745：トラストアンカーがmanaged-keysの使用時にサポートされていないキーアルゴリズムにロールオーバーした場合のアサーション失敗（bsc#1126068）

  - CVE-2018-5743：多数の同時TCP接続によって引き起こされる可能性があるサービス拒否の脆弱性を修正しました（bsc#1133185）。

  - CVE-2018-5740：deny-answer-aliases機能でのサービス拒否の脆弱性を修正しました（bsc#1104129）。

この更新はSUSEからインポートされました：SLE-15：更新プロジェクトを更新します。

bind用のこの更新は、次の問題を修正します：

キャッシュサイドチャネル攻撃の軽減：

CVE-2019-6465：ゾーン転送の制御がDynamically Loadable Zonesに適切に適用されない可能性がある問題を修正しました（bsc#1126069）。

CVE-2019-6471：patch.cの到達可能なアサーションを修正しました。（bsc#1138687）

CVE-2018-5745：トラストアンカーがmanaged-keysの使用時にサポートされていないキーアルゴリズムにロールオーバーした場合のサービス拒否の脆弱性を修正しました（bsc#1126068）

CVE-2018-5743：多数の同時TCP接続によって引き起こされる可能性があるサービス拒否の脆弱性を修正しました（bsc#1133185）。

CVE-2018-5740：deny-answer-aliases機能でのサービス拒否の脆弱性を修正しました（bsc#1104129）。

修正された非セキュリティ問題：named.serviceおよびlwresd.serviceのnss-lookup.targetに対する適切な依存関係について、/etc/insserv.confに依存しなくなりました（bsc#1118367、bsc#1118368）。

FIPS関連のリグレッションを修正します（bsc#1128220）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

bindの更新プログラムが、Red Hat Enterprise Linux 6で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度高と評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。BIND（Berkeley Internet Name Domain）は、DNS（ドメインネームシステム）プロトコルの実装です。BINDには、DNSサーバー（named）、リゾルバーライブラリ（DNSとインターフェイス接続する時に使用するアプリケーション用ルーチン）、DNSサーバーが正常動作していることを検証するツールが含まれます。セキュリティ修正プログラム：* bind：「deny-answer-aliases」の使用中に特定のレコードを処理するときに、サービス拒否を引き起こすアサートをトリガーする可能性があります（CVE-2018-5740）影響、CVSSスコア、その他の関連情報を含むセキュリティの問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。Red Hatは、この問題を報告したISCに感謝の意を表します。アップストリームは、Tony Finch氏（ケンブリッジ大学）を最初の報告者として認めています。

This update for bind fixes the following issues :

Security issues fixed :

CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).

CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687)

CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (bsc#1126068).

CVE-2018-5743: Fixed a denial of service vulnerability which could be caused by to many simultaneous TCP connections (bsc#1133185).

CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

Non-security issues fixed: Don't rely on /etc/insserv.conf anymore for proper dependencies against nss-lookup.target in named.service and lwresd.service (bsc#1118367, bsc#1118368).

Fix FIPS related regression (bsc#1128220).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is 9.x.x prior to 9.9.13-P1, 9.10.x prior to 9.10.8-P1, 9.11.x prior to 9.11.4-P1, or 9.12.x prior to 9.12.2-P1. It is, therefore, affected by a denial of service vulnerability in the deny-answer-aliases feature.

Update to 9.11.4-P1

  - Fixes CVE-2018-5738

  - Adds root key sentinel mechanism support

  - incremental zone transfer limit to prevent journal     corruption

  - rndc reload memory leak

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2570 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: processing of certain records when deny-answer-aliases is in use may trigger an assert leading     to a denial of service (CVE-2018-5740)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank ISC for reporting this issue. Upstream acknowledges Tony Finch (University of     Cambridge) as the original reporter.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2018-5740 The 'deny-answer-aliases' feature in BIND has a flaw which can cause named to exit with an assertion failure.

For Debian 8 'Jessie', this problem has been fixed in version 1:9.9.5.dfsg-9+deb8u16.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A denial of service flaw was discovered in bind     versions that include the 'deny-answer-aliases'     feature. This flaw may allow a remote attacker to     trigger an INSIST assert in named leading to     termination of the process and a denial of service     condition.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - 'deny-answer-aliases' is a little-used feature intended     to help recursive server operators protect end users     against DNS rebinding attacks, a potential method of     circumventing the security model used by client     browsers. However, a defect in this feature makes it     easy, when the feature is in use, to experience an     assertion failure in name.c. Affects BIND     9.7.0-i1/4z9.8.8, 9.9.0-i1/4z9.9.13, 9.10.0-i1/4z9.10.8,     9.11.0-i1/4z9.11.4, 9.12.0-i1/4z9.12.2,     9.13.0-i1/4z9.13.2.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

Security issues fixed :

CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).

CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (bsc#1126068).

CVE-2018-5743: Fixed a denial of service vulnerability which could be caused by to many simultaneous TCP connections (bsc#1133185).

CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

Security issues fixed :

CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).

CVE-2018-5745: An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys.
(bsc#1126068)

CVE-2018-5743: Limiting simultaneous TCP clients is ineffective.
(bsc#1133185)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

Security issues fixed :

  - CVE-2019-6465: Fixed an issue where controls for zone     transfers may not be properly applied to Dynamically     Loadable Zones (bsc#1126069).

  - CVE-2018-5745: Fixed a denial of service vulnerability     if a trust anchor rolls over to an unsupported key     algorithm when using managed-keys (bsc#1126068).

  - CVE-2018-5743: Fixed a denial of service vulnerability     which could be caused by to many simultaneous TCP     connections (bsc#1133185).

  - CVE-2018-5740: Fixed a denial of service vulnerability     in the 'deny-answer-aliases' feature (bsc#1104129).

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version MAIN 4.05, has bind packages installed that are affected by a vulnerability:

  - A denial of service flaw was discovered in bind versions     that include the deny-answer-aliases feature. This     flaw may allow a remote attacker to trigger an INSIST     assert in named leading to termination of the process     and a denial of service condition. (CVE-2018-5740)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* bind: processing of certain records when 'deny-answer-aliases' is in use may trigger an assert leading to a denial of service (CVE-2018-5740)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank ISC for reporting this issue. Upstream acknowledges Tony Finch (University of Cambridge) as the original reporter.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
125799	SUSE SLES12セキュリティ更新プログラム：bind（SUSE-SU-2019:1449-1）	Nessus	SuSE Local Security Checks	2019/6/10	2021/1/13	medium
125808	openSUSEセキュリティ更新プログラム：bind（openSUSE-2019-1533）	Nessus	SuSE Local Security Checks	2019/6/11	2020/9/23	medium
129526	SUSE SLED12 / SLES12セキュリティ更新プログラム：bind（SUSE-SU-2019:2502-1）	Nessus	SuSE Local Security Checks	2019/10/2	2021/1/13	medium
112165	CentOS 6：bind（CESA-2018:2571）	Nessus	CentOS Local Security Checks	2018/8/29	2024/8/14	high
129526	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2019:2502-1)	Nessus	SuSE Local Security Checks	2019/10/2	2021/1/13	medium
111790	ISC BIND 9.x.x < 9.9.13-P1 / 9.10.x < 9.10.8-P1 / 9.11.x < 9.11.4-P1 / 9.12.x < 9.12.2-P1 deny-answer-aliases DoS Vulnerability	Nessus	DNS	2018/8/16	2019/11/4	high
112068	Fedora 27 : 32:bind (2018-90f8fbd58e)	Nessus	Fedora Local Security Checks	2018/8/23	2024/8/15	high
112133	RHEL 7 : bind (RHSA-2018:2570)	Nessus	Red Hat Local Security Checks	2018/8/28	2024/11/5	high
112197	Debian DLA-1485-1 : bind9 security update	Nessus	Debian Local Security Checks	2018/8/31	2024/8/13	high
118416	EulerOS Virtualization 2.5.1 : bind (EulerOS-SA-2018-1328)	Nessus	Huawei Local Security Checks	2018/10/26	2022/2/3	high
122703	EulerOS Virtualization 2.5.2 : bind (EulerOS-SA-2019-1081)	Nessus	Huawei Local Security Checks	2019/3/8	2024/6/14	high
125703	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2019:1407-1)	Nessus	SuSE Local Security Checks	2019/6/4	2021/1/13	medium
125799	SUSE SLES12 Security Update : bind (SUSE-SU-2019:1449-1)	Nessus	SuSE Local Security Checks	2019/6/10	2021/1/13	medium
125808	openSUSE Security Update : bind (openSUSE-2019-1533)	Nessus	SuSE Local Security Checks	2019/6/11	2020/9/23	medium
127383	NewStart CGSL MAIN 4.05 : bind Vulnerability (NS-SA-2019-0130)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
112165	CentOS 6 : bind (CESA-2018:2571)	Nessus	CentOS Local Security Checks	2018/8/29	2024/8/14	high

检测

插件搜索

medium

medium

medium

high

medium

high

high

high

high

high

high

medium

medium

medium

high

high