Detections
Analytics
FreeBSD : BIND -- multiple vulnerabilities (c6861494-1ffb-11e7-934d-d05099c0ae8c)
high Nessus Plugin ID 99325
Language:
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
ISC reports :A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.
An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met.
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.
A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.
Solution
Update the affected packages.See Also
https://kb.isc.org/docs/aa-01465
https://kb.isc.org/docs/aa-01466
Plugin Details
Severity: High
ID: 99325
File Name: freebsd_pkg_c68614941ffb11e7934dd05099c0ae8c.nasl
Version: 3.9
Type: local
Family: FreeBSD Local Security Checks
Published: 4/13/2017
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:bind9-devel, p-cpe:/a:freebsd:freebsd:bind910, p-cpe:/a:freebsd:freebsd:bind911, p-cpe:/a:freebsd:freebsd:bind99, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 4/13/2017
Vulnerability Publication Date: 4/12/2017