According to its self-reported version number, the remote installation of BIND will exit with an assertion failure if a resource record with RDATA in excess of 65535 bytes is loaded and then subsequently queried.  Note that Nessus has only relied on the version itself and has not attempted to determine whether or not the install is actually affected.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

This update also fixes the following bug :

  - The bind-chroot-admin script, executed when upgrading     the bind-chroot package, failed to correctly update the     permissions of the /var/named/chroot/etc/named.conf     file. Depending on the permissions of the file, this     could have prevented named from starting after     installing package updates. With this update,     bind-chroot-admin correctly updates the permissions and     ownership of the file. Users of bind are advised to     upgrade to these updated packages, which correct these     issues. After installing the update, the BIND daemon     (named) will be restarted automatically.

The bind nameserver was updated to version 9.6-ESV-R7-P3 to fix a single security problem, where loading a zone file could have caused an assertion (abort) of the named service. (CVE-2012-4244)

The following issue has been fixed :

  - Specially crafted RDATA could have caused bind to     lockup. A different flaw than CVE-2012-4244.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1266 advisory.

    [32:9.7.0-10.P2.3]
    - fix CVE-2012-4244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

It was discovered that BIND, a DNS server, does not handle DNS records properly which approach size limits inherent to the DNS protocol. An attacker could use crafted DNS records to crash the BIND server process, leading to a denial of service.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

  - Fix (CVE-2016-2848)

  - Fix infinite loop in start_lookup (#1306504)

  - Fix (CVE-2016-2776)

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

Users of bind are advised to upgrade to these updated packages, which correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

Update to the 9.9.1-P3 security release. This update also fixes following issues :

  - named NetworkManager dispatcher script contained wrong     path to systemcl utility. (BZ#837173)

  - named-chroot.service unit didn't work properly.
    (BZ#825869)

  - bind-devel package wasn't multilib clean. (BZ#478718)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201209-04 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND:
      Domain names are not properly revoked due to an error in the cache         update policy (CVE-2012-1033).
      BIND accepts records with zero-length RDATA fields (CVE-2012-1667).
      An assertion failure from the failing-query cache could occur when         DNSSEC validation is enabled (CVE-2012-3817).
      A memory leak may occur under high TCP query loads (CVE-2012-3868).
      An assertion error can occur when a query is performed for a record         with RDATA greater than 65535 bytes (CVE-2012-4244).
  Impact :

    A remote attacker may be able to cause a Denial of Service condition or       keep domain names resolvable after it has been deleted from registration.
  Workaround :

    There is no known workaround at this time.

The following issue has been fixed :

  - Specially crafted RDATA could have caused bind to     lockup. This is a different flaw than CVE-2012-4244.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1268 advisory.

    [32:9.8.2-0.10.rc1.3]
    - fix  CVE-2012-4244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[20:9.2.4-38.0.2.el4]
- fix CVE-2012-4244 (Adam Tkac) [orabz 14518]
- fix CVE-2012-5166 (Adam Tkac) [orabz 14518]

A flaw was found in the way BIND handled resource records with a large RDATA value. A malicious owner of a DNS domain could use this flaw to create specially crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure. (CVE-2012-4244)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
62119	ISC BIND Assertion Error Resource Record RDATA Query Parsing Remote DoS	Nessus	DNS	2012/9/17	2018/9/17	high
62172	Scientific Linux Security Update : bind on SL5.x i386/x86_64 (20120914)	Nessus	Scientific Linux Local Security Checks	2012/9/18	2021/1/14	high
62176	SuSE 10 Security Update : bind (ZYPP Patch Number 8298)	Nessus	SuSE Local Security Checks	2012/9/18	2021/1/19	high
62674	SuSE 10 Security Update : bind (ZYPP Patch Number 8322)	Nessus	SuSE Local Security Checks	2012/10/24	2021/1/19	high
64114	SuSE 11.2 Security Update : bind (SAT Patch Number 6830)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	high
68623	Oracle Linux 5 : bind97 (ELSA-2012-1266)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	2013/9/13	2024/5/28	critical
62067	Debian DSA-2547-1 : bind9 - improper assert	Nessus	Debian Local Security Checks	2012/9/13	2021/1/11	high
99569	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	2017/4/21	2025/12/23	medium
62126	CentOS 6 : bind (CESA-2012:1268)	Nessus	CentOS Local Security Checks	2012/9/18	2021/1/4	high
62228	Fedora 17 : bind-9.9.1-9.P3.fc17 (2012-14106)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
62237	GLSA-201209-04 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/9/24	2021/1/6	high
64115	SuSE 11.2 Security Update : bind (SAT Patch Number 6944)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	high
68625	Oracle Linux 6 : bind (ELSA-2012-1268)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
68642	Oracle Linux 4 : bind (ELSA-2012-1365)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
69614	Amazon Linux AMI : bind (ALAS-2012-124)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	high

检测

插件搜索

high

high

high

high

high

critical

critical

high

medium

high

high

high

high

critical

high

high