An update of the bindutils package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0922 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation     (CVE-2020-8625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1485 advisory.

    A buffer overflow flaw was found in the SPNEGO implementation used by BIND. This flaw allows a remote     attacker to cause the named process to crash or possibly perform remote code execution. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-8625)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - BIND servers are vulnerable if they are running an     affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default     settings the vulnerable code path is not exposed, but a     server can be rendered vulnerable by explicitly setting     valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although     the default configuration is not vulnerable, GSS-TSIG     is frequently used in networks where BIND is integrated     with Samba, as well as in mixed-server environments     that combine BIND servers with Active Directory domain     controllers. The most likely outcome of a successful     exploitation of the vulnerability is a crash of the     named process. However, remote code execution, while     unproven, is theoretically possible. Affects: BIND     9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND     9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of     BIND Supported Preview Edition. Also release versions     9.17.0 -> 9.17.1 of the BIND 9.17 development     branch(CVE-2020-8625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:14632-1 advisory.

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has bind packages installed that are affected by a vulnerability:

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0025 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-6465:
    Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones     are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and     versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for     vulnerability to CVE-2019-6465.

    CVE-2019-6471:
    A race condition which may occur when discarding malformed packets can result in BIND exiting due to a     REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1,     9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND     9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.

    CVE-2020-8617:
    Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the     server. Since BIND, by default, configures a local session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating     from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately     exits. Prior to the introduction of the check the server would continue operating in an inconsistent     state, with potentially harmful results.

    CVE-2020-8622:
    In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

    CVE-2020-8623:
    In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker

    CVE-2020-8624:
    In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone.

    CVE-2020-8625:
    BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:0670 advisory.

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

  - In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and     9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11     of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR     triggering the flaw described above, the named process will terminate due to a failed assertion the next     time the transferred secondary zone is refreshed. (CVE-2021-25214)

  - In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 ->     9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND     9.17 development branch, when a vulnerable version of named receives a query for a record triggering the     flaw described above, the named process will terminate due to a failed assertion check. The vulnerability     affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other     versions of BIND 9. (CVE-2021-25215)

  - In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 ->     9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND     9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing     can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it     possible for its internal data structures to grow almost infinitely, which may cause significant delays in     client query processing. (CVE-2021-25219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack [bsc#1182246, CVE-2020-8625]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a buffer overflow attack in the bind9 DNS server caused by an issue in the GSSAPI ('Generic Security Services') security policy negotiation.

For Debian 9 'Stretch', this problem has been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u8.

We recommend that you upgrade your bind9 packages.

For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - BIND servers are vulnerable if they are running an     affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default     settings the vulnerable code path is not exposed, but a     server can be rendered vulnerable by explicitly setting     valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although     the default configuration is not vulnerable, GSS-TSIG     is frequently used in networks where BIND is integrated     with Samba, as well as in mixed-server environments     that combine BIND servers with Active Directory domain     controllers. The most likely outcome of a successful     exploitation of the vulnerability is a crash of the     named process. However, remote code execution, while     unproven, is theoretically possible.(CVE-2020-8625)

  - In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 ->     9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and     9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview     Edition, as well as release versions 9.17.0 -> 9.17.11     of the BIND 9.17 development branch, when a vulnerable     version of named receives a malformed IXFR triggering     the flaw described above, the named process will     terminate due to a failed assertion the next time the     transferred secondary zone is     refreshed.(CVE-2021-25214)

  - In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and     versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 ->     9.16.13-S1 of BIND Supported Preview Edition, as well     as release versions 9.17.0 -> 9.17.11 of the BIND 9.17     development branch, when a vulnerable version of named     receives a query for a record triggering the flaw     described above, the named process will terminate due     to a failed assertion check.(CVE-2021-25215)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
147820	Photon OS 3.0: Bindutils PHSA-2021-3.0-0207	Nessus	PhotonOS Local Security Checks	2021/3/16	2025/8/22	high
147867	RHEL 8 : bind (RHSA-2021:0922)	Nessus	Red Hat Local Security Checks	2021/3/17	2024/11/7	high
147916	Amazon Linux AMI : bind (ALAS-2021-1485)	Nessus	Amazon Linux Local Security Checks	2021/3/20	2024/12/11	high
150192	EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-1918)	Nessus	Huawei Local Security Checks	2021/6/3	2023/12/27	high
150654	SUSE SLES11 Security Update : bind (SUSE-SU-2021:14632-1)	Nessus	SuSE Local Security Checks	2021/6/10	2021/6/10	high
154595	NewStart CGSL MAIN 6.02 : bind Vulnerability (NS-SA-2021-0119)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2021/10/28	high
236577	Alibaba Cloud Linux 3 : 0025: bind (ALINUX3-SA-2021:0025)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
157703	AlmaLinux 8 : bind (ALSA-2021:0670)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	high
170823	EulerOS Virtualization 3.0.2.2 : bind (EulerOS-SA-2023-1244)	Nessus	Huawei Local Security Checks	2023/1/30	2023/1/30	high
146597	SUSE SLES12 Security Update : bind (SUSE-SU-2021:0504-1)	Nessus	SuSE Local Security Checks	2021/2/19	2021/3/2	high
146736	Debian DLA-2568-1 : bind9 security update	Nessus	Debian Local Security Checks	2021/2/22	2021/3/2	high
149096	EulerOS 2.0 SP3 : bind (EulerOS-SA-2021-1766)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/3	high
153289	EulerOS 2.0 SP2 : bind (EulerOS-SA-2021-2354)	Nessus	Huawei Local Security Checks	2021/9/14	2021/9/16	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high