The remote host is affected by the vulnerability described in GLSA-201701-26 (BIND: Denial of Service)

    A defect in BIND&rsquo;s handling of responses containing a DNAME answer can       cause a resolver to exit after encountering an assertion failure in db.c       or resolver.c.
  Impact :

    A remote attacker could send a specially crafted DNS request to the BIND       resolver possibly resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of bind installed on the remote AIX host is affected by the following vulnerabilities :

  - A denial of service vulnerability exists when handling     malformed options sections. An unauthenticated, remote     attacker can exploit this, via a specially crafted OPT     resource record, to cause an assertion failure,     resulting in a daemon exit. (CVE-2016-2848)

  - A denial of service vulnerability exists due to improper     handling of a recursive response containing a DNAME     record in the answer section. An unauthenticated, remote     attacker can exploit this to cause an assertion failure     and daemon exit. (CVE-2016-8864)

An update for bind97 is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-8864)

Red Hat would like to thank ISC for reporting this issue. Upstream acknowledges Tony Finch (University of Cambridge) and Marco Davids (SIDN Labs) as the original reporters.

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-8864)

Red Hat would like to thank ISC for reporting this issue. Upstream acknowledges Tony Finch (University of Cambridge) and Marco Davids (SIDN Labs) as the original reporters.

Tony Finch and Marco Davids reported an assertion failure in BIND, a DNS server implementation, which causes the server process to terminate. This denial-of-service vulnerability is related to a defect in the processing of responses with DNAME records from authoritative servers and primarily affects recursive resolvers.

Security fix for CVE-2016-6170

----

Security fix for CVE-2016-8864

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2142 advisory.

    [32:9.7.0-21.P2.9]
    - Fix CVE-2016-8864

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

  - A defect in BIND's handling of responses containing a     DNAME answer had the potential to trigger assertion     errors in the server remotely, thereby facilitating a     denial-of-service attack. (CVE-2016-8864, bsc#1007829).

  - Fix BIND to return a valid hostname in response to     ldapdump queries. (bsc#965748)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

  - A defect in BIND's handling of responses containing a     DNAME answer had the potential to trigger assertion     errors in the server remotely, thereby facilitating a     denial-of-service attack. (CVE-2016-8864, bsc#1007829).

This update for bind fixes the following security issue :

  - A defect in BIND's handling of responses containing a     DNAME answer had the potential to trigger assertion     errors in the server remotely, thereby facilitating a     denial-of-service attack. (CVE-2016-8864, bsc#1007829).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix DNSKEY that encountered a CNAME (#1447869, ISC     change 3391)

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-923:04 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS     (Domain Name System) protocols. BIND includes a DNS server (named),     which resolves host names to IP addresses; a resolver library     (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating properly.
    Security issues fixed with this release:
    CVE-2016-8864     named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and     9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of     service (assertion failure and daemon exit) via a DNAME record in the     answer section of a response to a recursive query, related to db.c and     resolver.c.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-8864

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96420	GLSA-201701-26 : BIND: Denial of Service	Nessus	Gentoo Local Security Checks	2017/1/12	2026/1/6	high
102126	AIX bind Advisory : bind_advisory14.asc (IV91214) (IV91253) (IV91254) (IV91255) (IV91256) (IV91257)	Nessus	AIX Local Security Checks	2017/8/3	2025/12/4	high
94472	CentOS 5 : bind97 (CESA-2016:2142)	Nessus	CentOS Local Security Checks	2016/11/3	2021/1/4	high
95354	CentOS 7 : bind (CESA-2016:2615)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	high
94478	Debian DSA-3703-1 : bind9 - security update	Nessus	Debian Local Security Checks	2016/11/3	2026/1/20	high
95003	Fedora 25 : bind99 (2016-567a5591e4)	Nessus	Fedora Local Security Checks	2016/11/21	2026/1/16	high
94496	Oracle Linux 5 : bind97 (ELSA-2016-2142)	Nessus	Oracle Linux Local Security Checks	2016/11/3	2025/4/29	high
94507	SUSE SLES11 Security Update : bind (SUSE-SU-2016:2706-1)	Nessus	SuSE Local Security Checks	2016/11/3	2026/1/20	high
94619	openSUSE Security Update : bind (openSUSE-2016-1272)	Nessus	SuSE Local Security Checks	2016/11/8	2026/1/19	high
94504	SUSE SLES12 Security Update : bind (SUSE-SU-2016:2696-1)	Nessus	SuSE Local Security Checks	2016/11/3	2026/1/20	high
100090	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0100)	Nessus	OracleVM Local Security Checks	2017/5/10	2025/12/19	high
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	2020/6/5	2024/3/7	medium
289606	MiracleLinux 7 : bind-9.9.4-38.0.1.el7.AXS7 (AXSA:2016-923:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
95305	Fedora 23 : bind99 (2016-8e39076950)	Nessus	Fedora Local Security Checks	2016/11/25	2026/1/16	high
94749	Fedora 24 : 32:bind (2016-e38196b52a)	Nessus	Fedora Local Security Checks	2016/11/14	2026/1/19	high
96590	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0033)	Nessus	OracleVM Local Security Checks	2017/1/18	2026/1/5	high
94503	RHEL 5 : bind97 (RHSA-2016:2142)	Nessus	Red Hat Local Security Checks	2016/11/3	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high