The remote host is affected by the vulnerability described in GLSA-201209-04 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND:
      Domain names are not properly revoked due to an error in the cache         update policy (CVE-2012-1033).
      BIND accepts records with zero-length RDATA fields (CVE-2012-1667).
      An assertion failure from the failing-query cache could occur when         DNSSEC validation is enabled (CVE-2012-3817).
      A memory leak may occur under high TCP query loads (CVE-2012-3868).
      An assertion error can occur when a query is performed for a record         with RDATA greater than 65535 bytes (CVE-2012-4244).
  Impact :

    A remote attacker may be able to cause a Denial of Service condition or       keep domain names resolvable after it has been deleted from registration.
  Workaround :

    There is no known workaround at this time.

The following issue has been fixed :

  - Specially crafted RDATA could have caused bind to     lockup. This is a different flaw than CVE-2012-4244.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1268 advisory.

    [32:9.8.2-0.10.rc1.3]
    - fix  CVE-2012-4244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[20:9.2.4-38.0.2.el4]
- fix CVE-2012-4244 (Adam Tkac) [orabz 14518]
- fix CVE-2012-5166 (Adam Tkac) [orabz 14518]

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-942:04 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND     includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for     applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating     properly.
    Security issues fixed with his release:
    CVE-2012-4244     ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before     9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon     exit) via a query for a long resource record.
    Fixed bug:
    The bind-chroot-admin script did not update the permissions of the /var/named/chroot/etc/named.conf file     correctly, which could prevent named from starting after update. This has been fixed.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-919:04 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND     includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for     applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating     properly.
    Security issues fixed with his release:
     CVE-2012-4244     ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before     9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon     exit) via a query for a long resource record.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

Users of bind are advised to upgrade to these updated packages, which correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

Updated bind packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

This update also fixes the following bug :

* The bind-chroot-admin script, executed when upgrading the bind-chroot package, failed to correctly update the permissions of the /var/named/chroot/etc/named.conf file. Depending on the permissions of the file, this could have prevented named from starting after installing package updates. With this update, bind-chroot-admin correctly updates the permissions and ownership of the file.
(BZ#857056)

Users of bind are advised to upgrade to these updated packages, which correct these issues. After installing the update, the BIND daemon (named) will be restarted automatically.

According to its self-reported version number, the remote installation of BIND will exit with an assertion failure if a resource record with RDATA in excess of 65535 bytes is loaded and then subsequently queried.  Note that Nessus has only relied on the version itself and has not attempted to determine whether or not the install is actually affected.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

This update also fixes the following bug :

  - The bind-chroot-admin script, executed when upgrading     the bind-chroot package, failed to correctly update the     permissions of the /var/named/chroot/etc/named.conf     file. Depending on the permissions of the file, this     could have prevented named from starting after     installing package updates. With this update,     bind-chroot-admin correctly updates the permissions and     ownership of the file. Users of bind are advised to     upgrade to these updated packages, which correct these     issues. After installing the update, the BIND daemon     (named) will be restarted automatically.

The bind nameserver was updated to version 9.6-ESV-R7-P3 to fix a single security problem, where loading a zone file could have caused an assertion (abort) of the named service. (CVE-2012-4244)

The following issue has been fixed :

  - Specially crafted RDATA could have caused bind to     lockup. A different flaw than CVE-2012-4244.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1266 advisory.

    [32:9.7.0-10.P2.3]
    - fix CVE-2012-4244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

bind was updated to 9.8.4-P2 to fix security problems and bugs.

Security Fixes Removed the check for regex.h in configure in order to disable regex syntax checking, as it exposes BIND to a critical flaw in libregex on some platforms. [CVE-2013-2266] [RT #32688] https://kb.isc.org/article/AA-00871 (bnc#811876) Prevents named from aborting with a require assertion failure on servers with DNS64 enabled. These crashes might occur as a result of specific queries that are received. (Note that this fix is a subset of a series of updates that will be included in full in BIND 9.8.5 and 9.9.3 as change #3388, RT #30996). [CVE-2012-5688] [RT #30792] A deliberately constructed combination of records could cause named to hang while populating the additional section of a response. [CVE-2012-5166] [RT #31090] Prevents a named assert (crash) when queried for a record whose RDATA exceeds 65535 bytes [CVE-2012-4244] [RT #30416] Prevents a named assert (crash) when validating caused by using 'Bad cache' data before it has been initialized. [CVE-2012-3817] [RT #30025] A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process. [CVE-2012-1667] [RT #29644] New Features Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are now supported per RFC 6605. [RT #21918] Feature Changes Improves OpenSSL error logging [RT #29932] nslookup now returns a nonzero exit code when it is unable to get an answer. [RT #29492] Bug Fixes Uses binary mode to open raw files on Windows. [RT #30944] Static-stub zones now accept 'forward' and 'fowarders' options (often needed for subdomains of the zone referenced to override global forwarding options). These options are already available with traditional stub zones and their omission from zones of type 'static-stub' was an inadvertent oversight. [RT #30482] Limits the TTL of signed RRsets in cache when their RRSIGs are approaching expiry. This prevents the persistence in cache of invalid RRSIGs in order to assist recovery from a situation where zone re-signing doesn't occur in a timely manner. With this change, named will attempt to obtain new RRSIGs from the authoritative server once the original ones have expired, and even if the TTL of the old records would in other circumstances cause them to be kept in cache for longer. [RT #26429] Corrects the syntax of isc_atomic_xadd() and isc_atomic_cmpxchg() which are employed on Itanium systems to speed up lock management by making use of atomic operations. Without the syntax correction it is possible that concurrent access to the same structures could accidentally occur with unpredictable results.
[RT #25181] The configure script now supports and detects libxml2-2.8.x correctly [RT #30440] The host command should no longer assert on some architectures and builds while handling the time values used with the -w (wait forever) option. [RT #18723] Invalid zero settings for max-retry-time, min-retry-time, max-refresh-time, min-refresh-time will now be detected during parsing of named.conf and an error emitted instead of triggering an assertion failure on startup. [RT #27730] Removes spurious newlines from log messages in zone.c [RT #30675] When built with readline support (i.e. on a system with readline installed) nsupdate no longer terminates unexpectedly in interactive mode. [RT #29550] All named tasks that perform task-exclusive operations now share the same single task. Prior to this change, there was the possibility of a race condition between rndc operations and other functions such as re-sizing the adb hash table. If the race condition was encountered, named would in most cases terminate unexpectedly with an assert. [RT #29872] Ensures that servers are expired from the ADB cache when the timeout limit is reached so that their learned attributes can be refreshed. Prior to this change, servers that were frequently queried might never have their entries removed and reinitialized. This is of particular importance to DNSSEC-validating recursive servers that might erroneously set 'no-edns' for an authoritative server following a period of intermittent connectivity. [RT #29856] Adds additional resilience to a previous security change (3218) by preventing RRSIG data from being added to cache when a pseudo-record matching the covering type and proving non-existence exists at a higher trust level. The earlier change prevented this inconsistent data from being retrieved from cache in response to client queries - with this additional change, the RRSIG records are no longer inserted into cache at all. [RT #26809] dnssec-settime will now issue a warning when the writing of a new private key file would cause a change in the permissions of the existing file. [RT #27724] Fixes the defect introduced by change #3314 that was causing failures when saving stub zones to disk (resulting in excessive CPU usage in some cases). [RT #29952] It is now possible to using multiple control keys again - this functionality was inadvertently broken by change #3924 (RT #28265) which addressed a memory leak. [RT #29694] Setting resolver-query-timeout too low could cause named problems recovering after a loss of connectivity. [RT #29623] Reduces the potential build-up of stale RRsets in cache on a busy recursive nameserver by re-using cached DS and RRSIG rrsets when possible [RT #29446] Corrects a failure to authenticate non-existence of resource records in some circumstances when RPZ has been configured. Also :

  - adds an optional 'recursive-only yes|no' to the     response-policy statement

  - adds an optional 'max-policy-ttl' to the response-policy     statement to limit the false data that 'recursive-only     no' can introduce into resolvers' caches

  - introduces a predefined encoding of PASSTHRU policy by     adding 'rpz-passthru' to be used as the target of CNAME     policy records (the old encoding is still accepted.)

  - adds a RPZ performance test to bin/tests/system/rpz when     queryperf is available. [RT #26172]     Upper-case/lower-case handling of RRSIG signer-names is     now handled consistently: RRSIG records are generated     with the signer-name in lower case. They are accepted     with any case, but if they fail to validate, we try     again in lower case. [RT #27451]

  - Update the IPv4 address of the D root name server.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
62237	GLSA-201209-04 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/9/24	2021/1/6	high
64115	SuSE 11.2 Security Update : bind (SAT Patch Number 6944)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	high
68625	Oracle Linux 6 : bind (ELSA-2012-1268)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
68642	Oracle Linux 4 : bind (ELSA-2012-1365)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
69614	Amazon Linux AMI : bind (ALAS-2012-124)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	high
283966	MiracleLinux 3 : bind-9.3.6-20.P1.4.0.1.AXS3 (AXSA:2012-942:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
284196	MiracleLinux 4 : bind-9.8.2-0.10.3.0.1rc1.AXS4 (AXSA:2012-919:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
62093	RHEL 6 : bind (RHSA-2012:1268)	Nessus	Red Hat Local Security Checks	2012/9/14	2021/1/14	high
62104	CentOS 5 : bind (CESA-2012:1267)	Nessus	CentOS Local Security Checks	2012/9/15	2021/1/4	high
62119	ISC BIND Assertion Error Resource Record RDATA Query Parsing Remote DoS	Nessus	DNS	2012/9/17	2018/9/17	high
62172	Scientific Linux Security Update : bind on SL5.x i386/x86_64 (20120914)	Nessus	Scientific Linux Local Security Checks	2012/9/18	2021/1/14	high
62176	SuSE 10 Security Update : bind (ZYPP Patch Number 8298)	Nessus	SuSE Local Security Checks	2012/9/18	2021/1/19	high
62674	SuSE 10 Security Update : bind (ZYPP Patch Number 8322)	Nessus	SuSE Local Security Checks	2012/10/24	2021/1/19	high
64114	SuSE 11.2 Security Update : bind (SAT Patch Number 6830)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	high
68623	Oracle Linux 5 : bind97 (ELSA-2012-1266)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
74953	openSUSE Security Update : bind (openSUSE-SU-2013:0605-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

检测

插件搜索

high

high

critical

high

high

critical

critical

high

high

high

high

high

high

high

critical

high