The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1781 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind9: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

    * bind9: Querying RFC 1918 reverse zones may cause an assertion failure when nxdomain-redirect is     enabled (CVE-2023-5517)

    * bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution     (CVE-2023-5679)

    * bind9: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)

    * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

    * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1781 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9     versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through     9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

  - A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

  - To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9     versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. (CVE-2023-6516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1789 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9     versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through     9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

  - A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

  - To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9     versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. (CVE-2023-6516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1781 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9     versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through     9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

  - A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

  - To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9     versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. (CVE-2023-6516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded.(CVE-2023-6516)

    A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled.(CVE-2023-5679)

    A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect domain;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. (CVE-2023-5517)

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the 'NSEC3' issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations.(CVE-2023-50868)

    Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     'KeyTrap' issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records.(CVE-2023-50387)

    The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers.(CVE-2023-4408)

Tenable has extracted the preceding description block directly from the EulerOS bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7866:02 advisory.

    * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)
      * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
      * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)
      * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution     (CVE-2023-5679)
      * bind: Querying RFC 1918 reverse zones may cause an assertion failure when nxdomain-redirect is enabled     (CVE-2023-5517)
      * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)     Bug Fix(es):
      * bind-dyndb-ldap: rebuilt to adapt ABI changes in bind

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7685:01 advisory.

    * bind9: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)
      * bind9: Querying RFC 1918 reverse zones may cause an assertion failure when nxdomain-redirect is     enabled (CVE-2023-5517)
      * bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution     (CVE-2023-5679)
      * bind9: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)
      * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
      * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-5679 advisory.

  - A bad interaction between DNS64 and serve-stale May cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-5679 advisory.

  - A bad interaction between DNS64 and serve-stale May cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded.(CVE-2023-6516)

    A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled.(CVE-2023-5679)

    A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect domain;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. (CVE-2023-5517)

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the 'NSEC3' issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations.(CVE-2023-50868)

    Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     'KeyTrap' issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records.(CVE-2023-50387)

    The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers.(CVE-2023-4408)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

The version of bind installed on the remote host is prior to 9.16.48 / 9.18.24. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-044-01 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6633-1 advisory.

    Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled     parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume     resources, leading to a denial of service. (CVE-2023-4408)

    Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Bind icorrectly handled     validating DNSSEC messages. A remote attacker could possibly use this issue to cause Bind to consume     resources, leading to a denial of service. (CVE-2023-50387)

    It was discovered that Bind incorrectly handled preparing an NSEC3 closest encloser proof. A remote     attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service.
    (CVE-2023-50868)

    It was discovered that Bind incorrectly handled reverse zone queries when nxdomain-redirect is enabled. A     remote attacker could possibly use this issue to cause Bind to crash, leading to a denial of service.
    (CVE-2023-5517)

    It was discovered that Bind incorrectly handled recursive resolution when both DNS64 and serve-stable were     enabled. A remote attacker could possibly use this issue to cause Bind to crash, leading to a denial of     service. (CVE-2023-5679)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0574-1 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9     versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through     9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

  - A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

  - To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9     versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. (CVE-2023-6516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-499b9be35f advisory.

    # Security Fixes

    -    Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading     to a denial-of-service condition. This has been fixed.
    ([CVE-2023-50387](https://kb.isc.org/docs/cve-2023-50387))

        ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner from the     German National Research Center for Applied Cybersecurity ATHENE for bringing this vulnerability to our     attention. [GL #4424]

    -    Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed.
    ([CVE-2023-4408](https://kb.isc.org/docs/cve-2023-4408))

        ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv     University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing     this vulnerability to our attention. [GL #4234]

    -    Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was     enabled. This has been fixed. ([CVE-2023-5517](https://kb.isc.org/docs/cve-2023-5517)) [GL #4281]

    -    A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure,     when both of these features were enabled. This has been fixed.
    ([CVE-2023-5679](https://kb.isc.org/docs/cve-2023-5679)) [GL #4334]

    ## Related blog post

    - [BIND 9 Security Release and Multi-Vendor Vulnerability Handling, CVE-2023-50387 and     CVE-2023-50868](https://www.isc.org/blogs/2024-bind-security-release/)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-550 advisory.

    The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers.This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

    Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause     a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many     DNSKEY and RRSIG records, aka the KeyTrap issue. The protocol specification implies that an algorithm     must evaluate all combinations of DNSKEY and RRSIG records. (CVE-2023-50387)

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

    A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:

    - `nxdomain-redirect <domain>;` is configured, and- the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response.This issue affects BIND 9     versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through     9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

    A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled.This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

    To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to     clean up the database. It uses several methods, including some that are asynchronous: a small chunk of     memory pointing to the cache element that can be cleaned up is first allocated and then queued for later     processing. It was discovered that if the resolver is continuously processing query patterns triggering     this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely     manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,     allowing the configured `max-cache-size` limit to be significantly exceeded.This issue affects BIND 9     versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. (CVE-2023-6516)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1647 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind9.16: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

    * bind9.16: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

    * bind9.16: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)

    * bind9.16: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution     (CVE-2023-5679)

    * bind9.16: Querying RFC 1918 reverse zones may cause an assertion failure when nxdomain-redirect is     enabled (CVE-2023-5517)

    * bind9.16: bind9: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
193198	RHEL 8 : bind9.16 (RHSA-2024:1781)	Nessus	Red Hat Local Security Checks	2024/4/11	2025/12/24	high
193275	AlmaLinux 8 : bind9.16 (ALSA-2024:1781)	Nessus	Alma Linux Local Security Checks	2024/4/12	2025/12/24	high
193280	AlmaLinux 9 : bind (ALSA-2024:1789)	Nessus	Alma Linux Local Security Checks	2024/4/12	2025/12/24	high
195015	Rocky Linux 8 : bind9.16 (RLSA-2024:1781)	Nessus	Rocky Linux Local Security Checks	2024/5/6	2025/12/24	high
198305	EulerOS 2.0 SP11 : bind (EulerOS-SA-2024-1783)	Nessus	Huawei Local Security Checks	2024/6/3	2025/12/24	high
291839	MiracleLinux 9 : bind-dyndb-ldap-11.9-9.el9.ML.1, bind-9.16.23-18.el9.1 (AXSA:2024-7866:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
292132	MiracleLinux 8 : bind9.16-9.16.23-0.16.el8_9.2.ML.1 (AXSA:2024-7685:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
201615	CBL Mariner 2.0 Security Update: bind (CVE-2023-5679)	Nessus	MarinerOS Local Security Checks	2024/7/3	2026/1/22	high
215598	Azure Linux 3.0 Security Update: bind (CVE-2023-5679)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/9/15	high
198102	EulerOS Virtualization 2.11.1 : bind (EulerOS-SA-2024-1712)	Nessus	Huawei Local Security Checks	2024/5/29	2025/12/24	high
204398	Photon OS 4.0: Bindutils PHSA-2024-4.0-0563	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/12/24	high
190442	Slackware Linux 15.0 / current bind Multiple Vulnerabilities (SSA:2024-044-01)	Nessus	Slackware Local Security Checks	2024/2/13	2024/7/26	high
190450	Ubuntu 22.04 LTS / 23.10 : Bind vulnerabilities (USN-6633-1)	Nessus	Ubuntu Local Security Checks	2024/2/13	2025/12/25	high
190882	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bind (SUSE-SU-2024:0574-1)	Nessus	SuSE Local Security Checks	2024/2/22	2025/12/25	high
190989	Fedora 39 : bind9-next (2024-499b9be35f)	Nessus	Fedora Local Security Checks	2024/2/26	2025/12/24	high
191615	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2024-550)	Nessus	Amazon Linux Local Security Checks	2024/3/6	2025/12/24	high
192863	RHEL 8 : bind9.16 (RHSA-2024:1647)	Nessus	Red Hat Local Security Checks	2024/4/2	2025/12/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high