name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0021 for details.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     constructed a response to a query that met certain     criteria. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure via a     specially crafted DNS request packet.(CVE-2016-2776)

  - A denial of service flaw was found in the way BIND     processed certain control channel input. A remote     attacker able to send a malformed packet to the control     channel could use this flaw to cause named to     crash.(CVE-2016-1285)

  - A flaw was found in the way BIND performed DNSSEC     validation. An attacker able to make BIND (functioning     as a DNS resolver with DNSSEC validation enabled)     resolve a name in an attacker-controlled domain could     cause named to exit unexpectedly with an assertion     failure.(CVE-2015-4620)

  - A flaw was found in the way BIND handled requests for     TKEY DNS resource records. A remote attacker could use     this flaw to make named (functioning as an     authoritative DNS server or a DNS resolver) exit     unexpectedly with an assertion failure via a specially     crafted DNS request packet.(CVE-2015-5477)

  - A denial of service flaw was found in the way BIND     handled queries for NSEC3-signed zones. A remote     attacker could use this flaw against an authoritative     name server that served NCES3-signed zones by sending a     specially crafted query, which, when processed, would     cause named to crash.(CVE-2014-0591)

  - A denial of service flaw was found in the way BIND     parsed certain malformed DNSSEC keys. A remote attacker     could use this flaw to send a specially crafted DNS     query (for example, a query requiring a response from a     zone containing a deliberately malformed key) that     would cause named functioning as a validating resolver     to crash.(CVE-2015-5722)

  - It was found that the lightweight resolver protocol     implementation in BIND could enter an infinite     recursion and crash when asked to resolve a query name     which, when combined with a search list entry, exceeds     the maximum allowable length. A remote attacker could     use this flaw to crash lwresd or named when using the     'lwres' statement in named.conf.(CVE-2016-2775)

  - A denial of service flaw was found in the way BIND     processed certain records with malformed class     attributes. A remote attacker could use this flaw to     send a query to request a cached record with a     malformed class attribute that would cause named     functioning as an authoritative or recursive server to     crash. Note: This issue affects authoritative servers     as well as recursive servers, however authoritative     servers are at limited risk if they perform     authentication when making recursive queries to resolve     addresses for servers listed in NS     RRSETs.(CVE-2015-8000)

  - A denial of service flaw was found in the way BIND     handled responses containing a DNAME answer. A remote     attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response.(CVE-2016-8864)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response.(CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     followed DNS delegations. A remote attacker could use a     specially crafted zone containing a large number of     referrals which, when looked up and processed, would     cause named to use excessive amounts of memory or     crash.(CVE-2014-8500)

  - A flaw was found in the way BIND handled trust anchor     management. A remote attacker could use this flaw to     cause the BIND daemon (named) to crash under certain     conditions.(CVE-2015-1349)

  - A denial of service flaw was found in the way BIND     parsed signature records for DNAME records. By sending     a specially crafted query, a remote attacker could use     this flaw to cause named to crash.(CVE-2016-1286)

  - A use-after-free flaw leading to denial of service was     found in the way BIND internally handled cleanup     operations on upstream recursion fetch contexts. A     remote attacker could potentially use this flaw to make     named, acting as a DNSSEC validating resolver, exit     unexpectedly with an assertion failure via a specially     crafted DNS request.(CVE-2017-3145)

  - A denial of service flaw was found in the way BIND     handled query requests when using DNS64 with     'break-dnssec yes' option. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS     request.(CVE-2017-3136)

  - A flaw was found in the way BIND handled TSIG     authentication of AXFR requests. A remote attacker,     able to communicate with an authoritative BIND server,     could use this flaw to view the entire contents of a     zone by sending a specially constructed request     packet.(CVE-2017-3142)

  - A flaw was found in the way BIND handled TSIG     authentication for dynamic updates. A remote attacker     able to communicate with an authoritative BIND server     could use this flaw to manipulate the contents of a     zone, by forging a valid TSIG or SIG(0) signature for a     dynamic update request.(CVE-2017-3143)

  - A denial of service flaw was discovered in bind     versions that include the 'deny-answer-aliases'     feature. This flaw may allow a remote attacker to     trigger an INSIST assert in named leading to     termination of the process and a denial of service     condition.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

  - Fix (CVE-2016-2848)

  - Fix infinite loop in start_lookup (#1306504)

  - Fix (CVE-2016-2776)

The remote host is affected by the vulnerability described in GLSA-201510-01 (BIND: Denial of Service)

    A vulnerability has been discovered in BIND&rsquo;s named utility leading to       a Denial of Service condition.
  Impact :

    A remote attacker may be able to cause Denial of Service condition via       specially constructed zone data.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way BIND performed DNSSEC validation. An attacker able to make BIND (functioning as a DNS resolver with DNSSEC validation enabled) resolve a name in an attacker-controlled domain could cause named to exit unexpectedly with an assertion failure.
(CVE-2015-4620)

After installing the update, the BIND daemon (named) will be restarted automatically.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-5477)

  - Fix (CVE-2015-4620)

  - Resolves: 1215687 - DNS resolution failure in high load     environment with SERVFAIL and 'out of memory/success' in     the log

  - Fix (CVE-2015-1349)

  - Enable RPZ-NSIP and RPZ-NSDNAME during compilation     (#1176476)

  - Fix race condition when using isc__begin_beginexclusive     (#1175321)

  - Sanitize SDB API to better handle database errors     (#1146893)

  - Fix CVE-2014-8500 (#1171974)

  - Fix RRL slip behavior when set to 1 (#1112356)

  - Fix issue causing bind to hang after reload if using     DYNDB (#1142152)

From Red Hat Security Advisory 2015:1471 :

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND performed DNSSEC validation. An attacker able to make BIND (functioning as a DNS resolver with DNSSEC validation enabled) resolve a name in an attacker-controlled domain could cause named to exit unexpectedly with an assertion failure.
(CVE-2015-4620)

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND performed DNSSEC validation. An attacker able to make BIND (functioning as a DNS resolver with DNSSEC validation enabled) resolve a name in an attacker-controlled domain could cause named to exit unexpectedly with an assertion failure.
(CVE-2015-4620)

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

A flaw was found in the way BIND performed DNSSEC validation. An attacker able to make BIND (functioning as a DNS resolver with DNSSEC validation enabled) resolve a name in an attacker-controlled domain could cause named to exit unexpectedly with an assertion failure.

fix for CVE-2015-4620

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND performed DNSSEC validation. An attacker able to make BIND (functioning as a DNS resolver with DNSSEC validation enabled) resolve a name in an attacker-controlled domain could cause named to exit unexpectedly with an assertion failure.
(CVE-2015-4620)

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

From Red Hat Security Advisory 2015:1443 :

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND performed DNSSEC validation. An attacker able to make BIND (functioning as a DNS resolver with DNSSEC validation enabled) resolve a name in an attacker-controlled domain could cause named to exit unexpectedly with an assertion failure.
(CVE-2015-4620)

Red Hat would like to thank ISC for reporting this issue.

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

- update to 9.10.2-P2

    - fix for CVE-2015-4620

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

bind was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-1349: named in ISC BIND 9.7.0 through 9.9.6     before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC     validation and the managed-keys feature are enabled,     allowed remote attackers to cause a denial of service     (assertion failure and daemon exit, or daemon crash) by     triggering an incorrect trust-anchor management scenario     in which no key is ready for use (bsc#918330).

  - CVE-2014-8500: ISC BIND 9.0.x through 9.8.x, 9.9.0     through 9.9.6, and 9.10.0 through 9.10.1 did not limit     delegation chaining, which allowed remote attackers to     cause a denial of service (memory consumption and named     crash) via a large or infinite number of referrals     (bsc#908994).

  - CVE-2015-4620: Resolver crash when validating     (bsc#936476).

According to its self-reported version number, the remote installation of BIND is potentially affected by a denial of service vulnerability, when configured as a recursive resolver with DNSSEC validation, due to an error that occurs during the validation of specially crafted zone data returned in an answer to a recursive query. A remote attacker can exploit this, by causing a query to be performed against a maliciously constructed zone, to crash the resolver.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability has been found in the Internet Domain Name Server bind9 :

CVE-2015-4620

Breno Silveira Soares of Servico Federal de Processamento de Dados (SERPRO) discovered that the BIND DNS server is prone to a denial of service vulnerability. A remote attacker who can cause a validating resolver to query a zone containing specifically constructed contents can cause the resolver to terminate with an assertion failure, resulting in a denial of service to clients relying on the resolver.

For the squeeze distribution, these issues have been fixed in version 9.7.3.dfsg-1~squeeze15 of bind9.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

bind was updated to fix two security issues :

CVE-2015-1349: A problem with trust anchor management could have caused named to crash (bsc#918330).

CVE-2015-4620: Fix resolver crash when validating (bsc#936476).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

bind was updated to fix two security issues.

These security issues were fixed :

  - CVE-2015-1349: Named in ISC BIND 9.7.0 through 9.9.6     before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC     validation and the managed-keys feature are enabled,     allowed remote attackers to cause a denial of service     (assertion failure and daemon exit, or daemon crash) by     triggering an incorrect trust-anchor management scenario     in which no key is ready for use (bsc#918330).

  - CVE-2015-4620: Fixed resolver crash when validating     (bsc#936476).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Breno Silveira Soares discovered that Bind incorrectly handled certain zone data when configured to perform DNSSEC validation. A remote attacker could use this issue with specially crafted zone data to cause Bind to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Breno Silveira Soares of Servico Federal de Processamento de Dados (SERPRO) discovered that the BIND DNS server is prone to a denial of service vulnerability. A remote attacker who can cause a validating resolver to query a zone containing specifically constructed contents can cause the resolver to terminate with an assertion failure, resulting in a denial of service to clients relying on the resolver.

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

ID	Name	Product	Family	Severity
137170	OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	medium
124936	EulerOS Virtualization 3.0.1.0 : bind (EulerOS-SA-2019-1433)	Nessus	Huawei Local Security Checks	medium
99569	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	high
86435	GLSA-201510-01 : BIND: Denial of Service	Nessus	Gentoo Local Security Checks	high
85190	Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	high
85146	OracleVM 3.3 : bind (OVMSA-2015-0105)	Nessus	OracleVM Local Security Checks	high
85114	Oracle Linux 6 : bind (ELSA-2015-1471)	Nessus	Oracle Linux Local Security Checks	high
85054	F5 Networks BIG-IP : BIND vulnerability (SOL16912)	Nessus	F5 Networks Local Security Checks	high
85028	CentOS 6 : bind (CESA-2015:1471)	Nessus	CentOS Local Security Checks	high
84954	RHEL 6 : bind (RHSA-2015:1471)	Nessus	Red Hat Local Security Checks	high
84926	Amazon Linux AMI : bind (ALAS-2015-566)	Nessus	Amazon Linux Local Security Checks	high
84905	Fedora 21 : bind-9.9.6-9.P1.fc21 (2015-11484)	Nessus	Fedora Local Security Checks	high
84894	Scientific Linux Security Update : bind on SL7.x x86_64 (20150720)	Nessus	Scientific Linux Local Security Checks	high
84892	RHEL 7 : bind (RHSA-2015:1443)	Nessus	Red Hat Local Security Checks	high
84889	Oracle Linux 7 : bind (ELSA-2015-1443)	Nessus	Oracle Linux Local Security Checks	high
84883	CentOS 7 : bind (CESA-2015:1443)	Nessus	CentOS Local Security Checks	high
84852	Fedora 22 : bind-9.10.2-3.P2.fc22 (2015-11483)	Nessus	Fedora Local Security Checks	high
84816	openSUSE Security Update : bind (openSUSE-2015-494)	Nessus	SuSE Local Security Checks	high
84728	ISC BIND 9.7.x < 9.9.7-P1 / 9.10.x < 9.10.2-P2 Resolver DNSSEC Validation DoS	Nessus	DNS	high
84676	Debian DLA-270-1 : bind9 security update	Nessus	Debian Local Security Checks	high
84633	SUSE SLED11 / SLES11 Security Update : bind (SUSE-SU-2015:1205-1)	Nessus	SuSE Local Security Checks	high
84632	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2015:1204-1)	Nessus	SuSE Local Security Checks	high
84620	Ubuntu 14.04 LTS : Bind vulnerability (USN-2669-1)	Nessus	Ubuntu Local Security Checks	critical
84599	Debian DSA-3304-1 : bind9 - security update	Nessus	Debian Local Security Checks	high
84591	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-188-04)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2015-4620

critical

Tenable Plugins

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high