Updated bind packages fix security vulnerability :

By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and denial of service (up to and including termination of the named server process) (CVE-2014-8500).

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. (CVE-2014-8500)

After installing the update, the BIND daemon (named) will be restarted automatically.

bind has been updated to version 9.9.6P1, fixing the following security issue :

  - A flaw in delegation handling could be exploited to put     named into an infinite loop. This has been addressed by     placing limits on the number of levels of recursion     named will allow (default 7), and the number of     iterative queries that it will send (default 50) before     terminating a recursive query. (CVE-2014-8500,     bnc#908994)

  - The recursion depth limit is configured via the     'max-recursion-depth' option, and the query limit via     the 'max-recursion-queries' option. Additionally, two     non-security issues have been fixed :

  - Fix a multi-thread issue with IXFR. (bnc#882511)

  - Fix handling of TXT records in ldapdump. (bnc#743758)

CVE-2014-8500 ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. 

Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500

ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.

Updated bind packages fix security vulnerabilities :

By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and denial of service (up to and including termination of the named server process) (CVE-2014-8500).

Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-lookaside auto;' (as enabled in the Mandriva default configuration) or 'dnssec-validation auto;' (CVE-2015-1349).

bind was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-1349: named in ISC BIND 9.7.0 through 9.9.6     before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC     validation and the managed-keys feature are enabled,     allowed remote attackers to cause a denial of service     (assertion failure and daemon exit, or daemon crash) by     triggering an incorrect trust-anchor management scenario     in which no key is ready for use (bsc#918330).

  - CVE-2014-8500: ISC BIND 9.0.x through 9.8.x, 9.9.0     through 9.9.6, and 9.10.0 through 9.10.1 did not limit     delegation chaining, which allowed remote attackers to     cause a denial of service (memory consumption and named     crash) via a large or infinite number of referrals     (bsc#908994).

  - CVE-2015-4620: Resolver crash when validating     (bsc#936476).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

  - Fix (CVE-2016-2848)

  - Fix infinite loop in start_lookup (#1306504)

  - Fix (CVE-2016-2776)

The remote NewStart CGSL host, running version MAIN 6.02, has bind packages installed that are affected by multiple vulnerabilities:

  - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when     answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for     remote attackers to guess the next query id and perform DNS cache poisoning. (CVE-2007-2926)

  - Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions,     which allows local users to perform unauthorized named commands, such as causing a denial of service by     stopping named. (CVE-2007-6283)

  - Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in     FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
    (CVE-2008-0122)

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

  - BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL     DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a     malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. (CVE-2009-0025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that BIND, a DNS server, is prone to a denial of service vulnerability.

By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation.

This can lead to resource exhaustion and denial of service (up to and including termination of the named server process.)

Updated bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. (CVE-2014-8500)

All bind97 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201502-03 (BIND: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause a denial of service condition by the lack of       GeoIP databases, or via a large or infinite number of referrals.
  Workaround :

    There is no known workaround at this time.

This update fixes a denial of service vulnerability in BIND, a DNS server.

By making use of maliciously-constructed zones or a rogue server, an attacker could exploit an oversight in the code BIND 9 used to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation.

This can lead to resource exhaustion and denial of service (up to and including termination of the named server process).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0078 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain     Name System (DNS) protocols. BIND includes a DNS server (named); a resolver     library (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating correctly.

    A denial of service flaw was found in the way BIND followed DNS     delegations. A remote attacker could use a specially crafted zone     containing a large number of referrals which, when looked up and processed,     would cause named to use excessive amounts of memory or crash.
    (CVE-2014-8500)

    A flaw was found in the way BIND handled requests for TKEY DNS resource     records. A remote attacker could use this flaw to make named (functioning     as an authoritative DNS server or a DNS resolver) exit unexpectedly with an     assertion failure via a specially crafted DNS request packet.
    (CVE-2015-5477)

    A denial of service flaw was found in the way BIND parsed certain malformed     DNSSEC keys. A remote attacker could use this flaw to send a specially     crafted DNS query (for example, a query requiring a response from a zone     containing a deliberately malformed key) that would cause named functioning     as a validating resolver to crash. (CVE-2015-5722)

    A denial of service flaw was found in the way BIND processed certain     records with malformed class attributes. A remote attacker could use this     flaw to send a query to request a cached record with a malformed class     attribute that would cause named functioning as an authoritative or     recursive server to crash. (CVE-2015-8000)

    Note: This issue affects authoritative servers as well as recursive     servers, however authoritative servers are at limited risk if they perform     authentication when making recursive queries to resolve addresses for     servers listed in NS RRSETs.

    Red Hat would like to thank ISC for reporting the CVE-2015-5477,     CVE-2015-5722, and CVE-2015-8000 issues. Upstream acknowledges Jonathan     Foote as the original reporter of CVE-2015-5477, and Hanno Bck as the     original reporter of CVE-2015-5722.

    All bind users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     update, the BIND daemon (named) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286     found by test suite

  - Fix (CVE-2016-1285, CVE-2016-1286)

  - Fix (CVE-2015-8704)

  - Fix (CVE-2015-8000)

  - Fix (CVE-2015-5722)

  - Fix (CVE-2015-5477)

  - Remove files backup after patching (Related: #1171971)

  - Fix CVE-2014-8500 (#1171971)

  - fix race condition in socket module

  - fix (CVE-2012-5166)

  - bind-chroot-admin: set correct permissions on     /etc/named.conf during update

  - fix (CVE-2012-4244)

  - fix (CVE-2012-3817)

  - fix (CVE-2012-1667)

  - fix (CVE-2012-1033)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79983	Mandriva Linux Security Advisory : bind (MDVSA-2014:238)	Nessus	Mandriva Local Security Checks	2014/12/15	2021/1/6	high
80020	Scientific Linux Security Update : bind on SL5.x, SL6.x, SL7.x i386/x86_64 (20141212)	Nessus	Scientific Linux Local Security Checks	2014/12/15	2021/1/14	high
80389	SuSE 11.3 Security Update : bind (SAT Patch Number 10100)	Nessus	SuSE Local Security Checks	2015/1/6	2021/1/19	high
81500	AIX 7.1 TL 2 : bind9 (IV68995)	Nessus	AIX Local Security Checks	2015/2/25	2023/4/21	high
81502	AIX 5.3 TL 12 : bind9 (IV68997)	Nessus	AIX Local Security Checks	2015/2/25	2023/4/21	high
81608	F5 Networks BIG-IP : BIND vulnerability (SOL15927)	Nessus	F5 Networks Local Security Checks	2015/3/5	2021/3/10	high
82418	Mandriva Linux Security Advisory : bind (MDVSA-2015:165)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	high
84816	openSUSE Security Update : bind (openSUSE-2015-494)	Nessus	SuSE Local Security Checks	2015/7/17	2021/1/19	high
99569	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	2017/4/21	2025/12/23	medium
206846	NewStart CGSL MAIN 6.02 : bind Multiple Vulnerabilities (NS-SA-2024-0060)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/18	medium
79808	Debian DSA-3094-1 : bind9 - security update	Nessus	Debian Local Security Checks	2014/12/9	2021/1/11	high
79881	CentOS 5 : bind97 (CESA-2014:1985)	Nessus	CentOS Local Security Checks	2014/12/15	2021/1/4	high
80019	Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20141212)	Nessus	Scientific Linux Local Security Checks	2014/12/15	2021/1/14	high
81226	GLSA-201502-03 : BIND: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2015/2/9	2021/1/11	high
82096	Debian DLA-112-1 : bind9 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	high
88479	RHEL 6 : bind (RHSA-2016:0078)	Nessus	Red Hat Local Security Checks	2016/1/29	2025/4/15	critical
91739	OracleVM 3.2 : bind (OVMSA-2016-0055)	Nessus	OracleVM Local Security Checks	2016/6/22	2021/1/4	high
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	2020/6/5	2024/3/7	medium

检测

插件搜索

high

high

high

high

high

high

high

high

medium

medium

high

high

high

high

high

critical

high

medium