The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-8000)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-953:07 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS     (Domain Name System) protocols. BIND includes a DNS server (named),     which resolves host names to IP addresses; a resolver library     (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating properly.
    Security issues fixed with this release:
    CVE-2015-8000
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute. (CVE-2015-8000)

Impact

An attack may cause a denial-of-service (DoS) on the vulnerable BIND system by requesting a record that contains a malformed class attribute.

Although the BIG-IP, BIG-IQ, and Enterprise Manager software contains the vulnerable code, the BIG-IP, BIG-IQ, and Enterprise Manager systems do not use the vulnerable code in a way that exposes the vulnerability in the default configuration.

The BIG-IP system must meet both of the following conditions to be considered vulnerable :

A listener object is configured to use the local BIND. For example :

A virtual server with a DNS profile is configured with the Use BIND Server on BIG-IP option (this option is enabled by default for the DNS profile)

A DNS/GTM pool uses the Return to DNS load balancing method or its Alternate and Fallback load balancing methods set to None and all pools associated with the wide IP are unavailable.

The local BIND configuration is enabled with the non-default recursion yes; option.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive server to crash. (CVE-2015-8000)

Note: This issue affects authoritative servers as well as recursive servers, however authoritative servers are at limited risk if they perform authentication when making recursive queries to resolve addresses for servers listed in NS RRSETs.

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

ISC reports :

Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.

Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]

Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT #40987]

It was discovered that the BIND DNS server does not properly handle the parsing of incoming responses, allowing some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. A remote attacker can exploit this flaw to cause a denial of service against servers performing recursive queries.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2837-1 advisory.

    It was discovered that Bind incorrectly handled responses with malformed class attributes. A remote     attacker could use this issue to cause Bind to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive server to crash. (CVE-2015-8000)

Note: This issue affects authoritative servers as well as recursive servers, however authoritative servers are at limited risk if they perform authentication when making recursive queries to resolve addresses for servers listed in NS RRSETs.

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2656 advisory.

    - Fix CVE-2015-8000
    - Fix CVE-2015-5722
    - Fix CVE-2015-5477

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

security fix

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

security update

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0079 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain     Name System (DNS) protocols. BIND includes a DNS server (named); a resolver     library (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating correctly.

    A flaw was found in the way BIND handled requests for TKEY DNS resource     records. A remote attacker could use this flaw to make named (functioning     as an authoritative DNS server or a DNS resolver) exit unexpectedly with an     assertion failure via a specially crafted DNS request packet.
    (CVE-2015-5477)

    A denial of service flaw was found in the way BIND parsed certain malformed     DNSSEC keys. A remote attacker could use this flaw to send a specially     crafted DNS query (for example, a query requiring a response from a zone     containing a deliberately malformed key) that would cause named functioning     as a validating resolver to crash. (CVE-2015-5722)

    A denial of service flaw was found in the way BIND processed certain     records with malformed class attributes. A remote attacker could use this     flaw to send a query to request a cached record with a malformed class     attribute that would cause named functioning as an authoritative or     recursive server to crash. (CVE-2015-8000)

    Note: This issue affects authoritative servers as well as recursive     servers, however authoritative servers are at limited risk if they perform     authentication when making recursive queries to resolve addresses for     servers listed in NS RRSETs.

    Red Hat would like to thank ISC for reporting the CVE-2015-5477,     CVE-2015-5722, and CVE-2015-8000 issues. Upstream acknowledges Jonathan     Foote as the original reporter of CVE-2015-5477, and Hanno Bck as the     original reporter of CVE-2015-5722.

    All bind users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     update, the BIND daemon (named) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
87489	OracleVM 3.3 : bind (OVMSA-2015-0156)	Nessus	OracleVM Local Security Checks	2015/12/18	2021/1/4	medium
289810	MiracleLinux 4 : bind-9.8.2-0.37.5.0.1.rc1.AXS4 (AXSA:2015-953:07)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
88851	F5 Networks BIG-IP : BIND vulnerability (K34250741)	Nessus	F5 Networks Local Security Checks	2016/2/19	2019/5/9	medium
87453	RHEL 6 / 7 : bind (RHSA-2015:2655)	Nessus	Red Hat Local Security Checks	2015/12/17	2019/10/24	medium
87375	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-349-01)	Nessus	Slackware Local Security Checks	2015/12/16	2021/1/14	high
87387	FreeBSD : bind -- multiple vulnerabilities (a8ec4db7-a398-11e5-85e9-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2015/12/16	2021/1/6	high
87384	Debian DSA-3420-1 : bind9 - security update	Nessus	Debian Local Security Checks	2015/12/16	2021/1/11	medium
87409	Ubuntu 14.04 LTS : Bind vulnerability (USN-2837-1)	Nessus	Ubuntu Local Security Checks	2015/12/16	2024/8/27	high
87424	CentOS 5 : bind (CESA-2015:2656)	Nessus	CentOS Local Security Checks	2015/12/17	2021/1/4	medium
87449	Oracle Linux 5 : bind (ELSA-2015-2656)	Nessus	Oracle Linux Local Security Checks	2015/12/17	2025/4/29	high
87454	RHEL 5 : bind (RHSA-2015:2656)	Nessus	Red Hat Local Security Checks	2015/12/17	2019/10/24	medium
89136	Fedora 23 : bind-9.10.3-7.P2.fc23 / bind-dyndb-ldap-8.0-4.fc23 / dnsperf-2.0.0.0-19.fc23 (2015-09bf9e06ea)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
89441	Fedora 22 : bind99-9.9.8-1.P2.fc22 / dhcp-4.3.2-6.fc22 (2015-e278e12ebc)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
88480	RHEL 6 : bind (RHSA-2016:0079)	Nessus	Red Hat Local Security Checks	2016/1/29	2025/4/15	critical

检测

插件搜索

medium

high

medium

medium

high

high

medium

high

medium

high

medium

high

medium

critical