The version of bind installed on the remote AIX host is affected by a denial of service vulnerability due to improper parsing of incorrect class attributes in db.c. An unauthenticated, remote attacker can exploit this, via a malformed class attribute, to trigger a REQUIRE assertion failure, resulting in a denial of service condition.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2655 advisory.

    [32:9.8.2-0.44.rc1.5]
    - Fix CVE-2015-8000

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive server to crash. (CVE-2015-8000)

Note: This issue affects authoritative servers as well as recursive servers, however authoritative servers are at limited risk if they perform authentication when making recursive queries to resolve addresses for servers listed in NS RRSETs.

After installing the update, the BIND daemon (named) will be restarted automatically.

This update fixes the following security issue :

  - CVE-2015-8000: Fix remote denial of service by     misparsing incoming responses (bsc#958861).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0078 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain     Name System (DNS) protocols. BIND includes a DNS server (named); a resolver     library (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating correctly.

    A denial of service flaw was found in the way BIND followed DNS     delegations. A remote attacker could use a specially crafted zone     containing a large number of referrals which, when looked up and processed,     would cause named to use excessive amounts of memory or crash.
    (CVE-2014-8500)

    A flaw was found in the way BIND handled requests for TKEY DNS resource     records. A remote attacker could use this flaw to make named (functioning     as an authoritative DNS server or a DNS resolver) exit unexpectedly with an     assertion failure via a specially crafted DNS request packet.
    (CVE-2015-5477)

    A denial of service flaw was found in the way BIND parsed certain malformed     DNSSEC keys. A remote attacker could use this flaw to send a specially     crafted DNS query (for example, a query requiring a response from a zone     containing a deliberately malformed key) that would cause named functioning     as a validating resolver to crash. (CVE-2015-5722)

    A denial of service flaw was found in the way BIND processed certain     records with malformed class attributes. A remote attacker could use this     flaw to send a query to request a cached record with a malformed class     attribute that would cause named functioning as an authoritative or     recursive server to crash. (CVE-2015-8000)

    Note: This issue affects authoritative servers as well as recursive     servers, however authoritative servers are at limited risk if they perform     authentication when making recursive queries to resolve addresses for     servers listed in NS RRSETs.

    Red Hat would like to thank ISC for reporting the CVE-2015-5477,     CVE-2015-5722, and CVE-2015-8000 issues. Upstream acknowledges Jonathan     Foote as the original reporter of CVE-2015-5477, and Hanno Bck as the     original reporter of CVE-2015-5722.

    All bind users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     update, the BIND daemon (named) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286     found by test suite

  - Fix (CVE-2016-1285, CVE-2016-1286)

  - Fix (CVE-2015-8704)

  - Fix (CVE-2015-8000)

  - Fix (CVE-2015-5722)

  - Fix (CVE-2015-5477)

  - Remove files backup after patching (Related: #1171971)

  - Fix CVE-2014-8500 (#1171971)

  - fix race condition in socket module

  - fix (CVE-2012-5166)

  - bind-chroot-admin: set correct permissions on     /etc/named.conf during update

  - fix (CVE-2012-4244)

  - fix (CVE-2012-3817)

  - fix (CVE-2012-1667)

  - fix (CVE-2012-1033)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-953:07 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS     (Domain Name System) protocols. BIND includes a DNS server (named),     which resolves host names to IP addresses; a resolver library     (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating properly.
    Security issues fixed with this release:
    CVE-2015-8000
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive server to crash. (CVE-2015-8000)

Note: This issue affects authoritative servers as well as recursive servers, however authoritative servers are at limited risk if they perform authentication when making recursive queries to resolve addresses for servers listed in NS RRSETs.

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-8000)

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute. (CVE-2015-8000)

Impact

An attack may cause a denial-of-service (DoS) on the vulnerable BIND system by requesting a record that contains a malformed class attribute.

Although the BIG-IP, BIG-IQ, and Enterprise Manager software contains the vulnerable code, the BIG-IP, BIG-IQ, and Enterprise Manager systems do not use the vulnerable code in a way that exposes the vulnerability in the default configuration.

The BIG-IP system must meet both of the following conditions to be considered vulnerable :

A listener object is configured to use the local BIND. For example :

A virtual server with a DNS profile is configured with the Use BIND Server on BIG-IP option (this option is enabled by default for the DNS profile)

A DNS/GTM pool uses the Return to DNS load balancing method or its Alternate and Fallback load balancing methods set to None and all pools associated with the wide IP are unavailable.

The local BIND configuration is enabled with the non-default recursion yes; option.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     constructed a response to a query that met certain     criteria. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure via a     specially crafted DNS request packet.(CVE-2016-2776)

  - A denial of service flaw was found in the way BIND     processed certain control channel input. A remote     attacker able to send a malformed packet to the control     channel could use this flaw to cause named to     crash.(CVE-2016-1285)

  - A flaw was found in the way BIND performed DNSSEC     validation. An attacker able to make BIND (functioning     as a DNS resolver with DNSSEC validation enabled)     resolve a name in an attacker-controlled domain could     cause named to exit unexpectedly with an assertion     failure.(CVE-2015-4620)

  - A flaw was found in the way BIND handled requests for     TKEY DNS resource records. A remote attacker could use     this flaw to make named (functioning as an     authoritative DNS server or a DNS resolver) exit     unexpectedly with an assertion failure via a specially     crafted DNS request packet.(CVE-2015-5477)

  - A denial of service flaw was found in the way BIND     handled queries for NSEC3-signed zones. A remote     attacker could use this flaw against an authoritative     name server that served NCES3-signed zones by sending a     specially crafted query, which, when processed, would     cause named to crash.(CVE-2014-0591)

  - A denial of service flaw was found in the way BIND     parsed certain malformed DNSSEC keys. A remote attacker     could use this flaw to send a specially crafted DNS     query (for example, a query requiring a response from a     zone containing a deliberately malformed key) that     would cause named functioning as a validating resolver     to crash.(CVE-2015-5722)

  - It was found that the lightweight resolver protocol     implementation in BIND could enter an infinite     recursion and crash when asked to resolve a query name     which, when combined with a search list entry, exceeds     the maximum allowable length. A remote attacker could     use this flaw to crash lwresd or named when using the     'lwres' statement in named.conf.(CVE-2016-2775)

  - A denial of service flaw was found in the way BIND     processed certain records with malformed class     attributes. A remote attacker could use this flaw to     send a query to request a cached record with a     malformed class attribute that would cause named     functioning as an authoritative or recursive server to     crash. Note: This issue affects authoritative servers     as well as recursive servers, however authoritative     servers are at limited risk if they perform     authentication when making recursive queries to resolve     addresses for servers listed in NS     RRSETs.(CVE-2015-8000)

  - A denial of service flaw was found in the way BIND     handled responses containing a DNAME answer. A remote     attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response.(CVE-2016-8864)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response.(CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     followed DNS delegations. A remote attacker could use a     specially crafted zone containing a large number of     referrals which, when looked up and processed, would     cause named to use excessive amounts of memory or     crash.(CVE-2014-8500)

  - A flaw was found in the way BIND handled trust anchor     management. A remote attacker could use this flaw to     cause the BIND daemon (named) to crash under certain     conditions.(CVE-2015-1349)

  - A denial of service flaw was found in the way BIND     parsed signature records for DNAME records. By sending     a specially crafted query, a remote attacker could use     this flaw to cause named to crash.(CVE-2016-1286)

  - A use-after-free flaw leading to denial of service was     found in the way BIND internally handled cleanup     operations on upstream recursion fetch contexts. A     remote attacker could potentially use this flaw to make     named, acting as a DNSSEC validating resolver, exit     unexpectedly with an assertion failure via a specially     crafted DNS request.(CVE-2017-3145)

  - A denial of service flaw was found in the way BIND     handled query requests when using DNS64 with     'break-dnssec yes' option. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS     request.(CVE-2017-3136)

  - A flaw was found in the way BIND handled TSIG     authentication of AXFR requests. A remote attacker,     able to communicate with an authoritative BIND server,     could use this flaw to view the entire contents of a     zone by sending a specially constructed request     packet.(CVE-2017-3142)

  - A flaw was found in the way BIND handled TSIG     authentication for dynamic updates. A remote attacker     able to communicate with an authoritative BIND server     could use this flaw to manipulate the contents of a     zone, by forging a valid TSIG or SIG(0) signature for a     dynamic update request.(CVE-2017-3143)

  - A denial of service flaw was discovered in bind     versions that include the 'deny-answer-aliases'     feature. This flaw may allow a remote attacker to     trigger an INSIST assert in named leading to     termination of the process and a denial of service     condition.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102122	AIX bind Advisory : bind_advisory10.asc (IV80187) (IV80188) (IV80189) (IV80191) (IV80192)	Nessus	AIX Local Security Checks	2017/8/3	2025/12/4	high
87448	Oracle Linux 6 / 7 : bind (ELSA-2015-2655)	Nessus	Oracle Linux Local Security Checks	2015/12/17	2024/11/1	high
87491	Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20151216)	Nessus	Scientific Linux Local Security Checks	2015/12/18	2021/1/14	medium
87653	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2015:2341-1)	Nessus	SuSE Local Security Checks	2015/12/29	2021/1/6	medium
88479	RHEL 6 : bind (RHSA-2016:0078)	Nessus	Red Hat Local Security Checks	2016/1/29	2025/4/15	critical
91739	OracleVM 3.2 : bind (OVMSA-2016-0055)	Nessus	OracleVM Local Security Checks	2016/6/22	2021/1/4	high
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	2020/6/5	2024/3/7	medium
289810	MiracleLinux 4 : bind-9.8.2-0.37.5.0.1.rc1.AXS4 (AXSA:2015-953:07)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
87453	RHEL 6 / 7 : bind (RHSA-2015:2655)	Nessus	Red Hat Local Security Checks	2015/12/17	2019/10/24	medium
87489	OracleVM 3.3 : bind (OVMSA-2015-0156)	Nessus	OracleVM Local Security Checks	2015/12/18	2021/1/4	medium
88851	F5 Networks BIG-IP : BIND vulnerability (K34250741)	Nessus	F5 Networks Local Security Checks	2016/2/19	2019/5/9	medium
124936	EulerOS Virtualization 3.0.1.0 : bind (EulerOS-SA-2019-1433)	Nessus	Huawei Local Security Checks	2019/5/14	2025/11/20	medium

检测

插件搜索

high

high

medium

medium

critical

high

medium

high

medium

medium

medium

medium