It was discovered that BIND, a DNS server, is prone to a denial of service vulnerability.

By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation.

This can lead to resource exhaustion and denial of service (up to and including termination of the named server process.)

Updated bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. (CVE-2014-8500)

All bind97 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. (CVE-2014-8500)

After installing the update, the BIND daemon (named) will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201502-03 (BIND: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause a denial of service condition by the lack of       GeoIP databases, or via a large or infinite number of referrals.
  Workaround :

    There is no known workaround at this time.

This update fixes a denial of service vulnerability in BIND, a DNS server.

By making use of maliciously-constructed zones or a rogue server, an attacker could exploit an oversight in the code BIND 9 used to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation.

This can lead to resource exhaustion and denial of service (up to and including termination of the named server process).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0078 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain     Name System (DNS) protocols. BIND includes a DNS server (named); a resolver     library (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating correctly.

    A denial of service flaw was found in the way BIND followed DNS     delegations. A remote attacker could use a specially crafted zone     containing a large number of referrals which, when looked up and processed,     would cause named to use excessive amounts of memory or crash.
    (CVE-2014-8500)

    A flaw was found in the way BIND handled requests for TKEY DNS resource     records. A remote attacker could use this flaw to make named (functioning     as an authoritative DNS server or a DNS resolver) exit unexpectedly with an     assertion failure via a specially crafted DNS request packet.
    (CVE-2015-5477)

    A denial of service flaw was found in the way BIND parsed certain malformed     DNSSEC keys. A remote attacker could use this flaw to send a specially     crafted DNS query (for example, a query requiring a response from a zone     containing a deliberately malformed key) that would cause named functioning     as a validating resolver to crash. (CVE-2015-5722)

    A denial of service flaw was found in the way BIND processed certain     records with malformed class attributes. A remote attacker could use this     flaw to send a query to request a cached record with a malformed class     attribute that would cause named functioning as an authoritative or     recursive server to crash. (CVE-2015-8000)

    Note: This issue affects authoritative servers as well as recursive     servers, however authoritative servers are at limited risk if they perform     authentication when making recursive queries to resolve addresses for     servers listed in NS RRSETs.

    Red Hat would like to thank ISC for reporting the CVE-2015-5477,     CVE-2015-5722, and CVE-2015-8000 issues. Upstream acknowledges Jonathan     Foote as the original reporter of CVE-2015-5477, and Hanno Bck as the     original reporter of CVE-2015-5722.

    All bind users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     update, the BIND daemon (named) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286     found by test suite

  - Fix (CVE-2016-1285, CVE-2016-1286)

  - Fix (CVE-2015-8704)

  - Fix (CVE-2015-8000)

  - Fix (CVE-2015-5722)

  - Fix (CVE-2015-5477)

  - Remove files backup after patching (Related: #1171971)

  - Fix CVE-2014-8500 (#1171971)

  - fix race condition in socket module

  - fix (CVE-2012-5166)

  - bind-chroot-admin: set correct permissions on     /etc/named.conf during update

  - fix (CVE-2012-4244)

  - fix (CVE-2012-3817)

  - fix (CVE-2012-1667)

  - fix (CVE-2012-1033)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-8500 (#1171973)

  - Use /dev/urandom when generating rndc.key file (#951255)

  - Remove bogus file from /usr/share/doc, introduced by fix     for bug #1092035

  - Add support for TLSA resource records (#956685)

  - Increase defaults for lwresd workers and make workers     and client objects number configurable (#1092035)

  - Fix segmentation fault in nsupdate when -r option is     used (#1064045)

  - Fix race condition on send buffer in host tool when     sending UDP query (#1008827)

  - Allow authentication using TSIG in allow-notify     configuration statement (#1044545)

  - Fix SELinux context of /var/named/chroot/etc/localtime     (#902431)

  - Include updated named.ca file with root server addresses     (#917356)

  - Don't generate rndc.key if there is rndc.conf on     start-up (#997743)

  - Fix dig man page regarding how to disable IDN (#1023045)

  - Handle ICMP Destination unreachable (Protocol     unreachable) response (#1066876)

  - Configure BIND with --with-dlopen=yes to support     dynamically loadable DLZ drivers (#846065)

  - Fix initscript to return correct exit value when calling     checkconfig/configtest/check/test (#848033)

  - Don't (un)mount chroot filesystem when running     initscript command configtest with running server     (#851123)

  - Fix zone2sqlite tool to accept zones containing '.' or     '-' or starting with a digit (#919414)

  - Fix initscript not to mount chroot filesystem is named     is already running (#948743)

  - Fix initscript to check if the PID in PID-file is really     s PID of running named server (#980632)

  - Correct the installed documentation ownership (#1051283)

  - configure with --enable-filter-aaaa to enable use of     filter-aaaa-on-v4 option (#1025008)

  - Fix race condition when destroying a resolver fetch     object (#993612)

  - Fix the RRL functionality to include     referrals-per-second and nodata-per-second options     (#1036700)

  - Fix segfault on SERVFAIL to NXDOMAIN failover (#919545)

  - Fix (CVE-2014-0591)

  - Fix gssapictx memory leak (#911167)

  - fix (CVE-2013-4854)

  - fix (CVE-2013-2266)

  - ship dns/rrl.h in -devel subpkg

  - remove one bogus file from /usr/share/doc, introduced by     RRL patch

  - fix (CVE-2012-5689)

  - add response rate limit patch (#873624)

According to its self-reported version number, the remote installation of BIND is potentially affected by multiple vulnerabilities :

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2014-8500 ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. 

Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500

Fix for CVE-2014-8500

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_headers module that allows HTTP     trailers to replace HTTP headers late during request     processing. A remote attacker can exploit this to inject     arbitrary headers. This can also cause some modules to     function incorrectly or appear to function incorrectly.
    (CVE-2013-5704)

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. (CVE-2014-0067)

  - A NULL pointer dereference flaw exists in module     mod_cache. A remote attacker, using an empty HTTP     Content-Type header, can exploit this vulnerability to     crash a caching forward proxy configuration, resulting     in a denial of service if using a threaded MPM.
    (CVE-2014-3581)

  - A out-of-bounds memory read flaw exists in module     mod_proxy_fcgi. An attacker, using a remote FastCGI     server to send long response headers, can exploit this     vulnerability to cause a denial of service by causing     a buffer over-read. (CVE-2014-3583)

  - A flaw exists in module mod_lua when handling a     LuaAuthzProvider used in multiple Require directives     with different arguments. An attacker can exploit this     vulnerability to bypass intended access restrictions.
    (CVE-2014-8109)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - A flaw exists in PostgreSQL client disconnect timeout     expiration that is triggered when a timeout interrupt     is fired partway through the session shutdown sequence.     (CVE-2015-3165)

  - A flaw exists in the printf() functions due to a failure     to check for errors. A remote attacker can use this to     gain access to sensitive information. (CVE-2015-3166)

  - The pgcrypto component in PostgreSQL has multiple error     messages for decryption with an incorrect key. A remote     attacker can use this to recover keys from other     systems. (CVE-2015-3167)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - Multiple unspecified XML flaws exist in the Wiki Server     based on Twisted. (CVE-2015-5911)

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

This update of bind to 9.9.6P1 fixes bugs and also the following security issue :

A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500, bnc#908994).

The recursion depth limit is configured via the 'max-recursion-depth' option, and the query limit via the 'max-recursion-queries' option.

Also the rpz2 patch was removed as it is no longer maintained.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This bind update to version 9.6-ESV-R11-W1 fixes the following security issue :

  - A flaw in delegation handling could be exploited to put     named into an infinite loop. This has been addressed by     placing limits on the number of levels of recursion     named will allow (default 7), and the number of     iterative queries that it will send (default 50) before     terminating a recursive query (CVE-2014-8500,     bnc#908994). The recursion depth limit is configured via     the 'max-recursion-depth' option, and the query limit     via the 'max-recursion-queries' option.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-5477)

  - Fix (CVE-2015-4620)

  - Resolves: 1215687 - DNS resolution failure in high load     environment with SERVFAIL and 'out of memory/success' in     the log

  - Fix (CVE-2015-1349)

  - Enable RPZ-NSIP and RPZ-NSDNAME during compilation     (#1176476)

  - Fix race condition when using isc__begin_beginexclusive     (#1175321)

  - Sanitize SDB API to better handle database errors     (#1146893)

  - Fix CVE-2014-8500 (#1171974)

  - Fix RRL slip behavior when set to 1 (#1112356)

  - Fix issue causing bind to hang after reload if using     DYNDB (#1142152)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79808	Debian DSA-3094-1 : bind9 - security update	Nessus	Debian Local Security Checks	2014/12/9	2021/1/11	high
79881	CentOS 5 : bind97 (CESA-2014:1985)	Nessus	CentOS Local Security Checks	2014/12/15	2021/1/4	high
80019	Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20141212)	Nessus	Scientific Linux Local Security Checks	2014/12/15	2021/1/14	high
81226	GLSA-201502-03 : BIND: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2015/2/9	2021/1/11	high
82096	Debian DLA-112-1 : bind9 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	high
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	2020/6/5	2026/10/8	medium
88479	RHEL 6 : bind (RHSA-2016:0078)	Nessus	Red Hat Local Security Checks	2016/1/29	2026/10/8	high
91739	OracleVM 3.2 : bind (OVMSA-2016-0055)	Nessus	OracleVM Local Security Checks	2016/6/22	2026/10/8	high
80247	OracleVM 3.3 : bind (OVMSA-2014-0084)	Nessus	OracleVM Local Security Checks	2014/12/26	2021/1/4	high
81490	ISC BIND 9.9.7.x < 9.9.7rc2 Multiple Vulnerabilities	Nessus	DNS	2015/2/24	2018/11/15	high
81499	AIX 6.1 TL 9 : bind9 (IV68994)	Nessus	AIX Local Security Checks	2015/2/25	2023/4/21	high
80013	RHEL 5 : bind97 (RHSA-2014:1985)	Nessus	Red Hat Local Security Checks	2014/12/15	2021/1/14	high
80091	Fedora 20 : bind-9.9.4-17.P2.fc20 (2014-16607)	Nessus	Fedora Local Security Checks	2014/12/18	2021/1/11	high
86066	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical
82914	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-111-01)	Nessus	Slackware Local Security Checks	2015/4/22	2021/1/14	high
83670	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2015:0096-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/6	high
83697	SUSE SLES10 Security Update : bind (SUSE-SU-2015:0488-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/6	high
85146	OracleVM 3.3 : bind (OVMSA-2015-0105)	Nessus	OracleVM Local Security Checks	2015/7/31	2026/10/8	high

检测

插件搜索

high

high

high

high

high

medium

high

high

high

high

high

high

high

critical

high

high

high

high