ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5747-1 advisory.

  - ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the     named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a     long request that uses the lightweight resolver protocol. (CVE-2016-2775)

  - ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS     servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly     allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows     remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE     message. (CVE-2016-6170)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1,     and 9.11.x through 9.11.0b1 allows primary DNS servers     to cause a denial of service (secondary DNS server     crash) via a large AXFR response, and possibly allows     IXFR servers to cause a denial of service (IXFR client     crash) via a large IXFR response and allows remote     authenticated users to cause a denial of service     (primary DNS server crash) via a large UPDATE     message.(CVE-2016-6170)

  - It was found that the controls for zone transfer were     not properly applied to Dynamically Loadable Zones     (DLZs). An attacker acting as a DNS client could use     this flaw to request and receive a zone transfer of a     DLZ even when not permitted to do so by the     'allow-transfer' ACL.(CVE-2019-6465)

  - To provide fine-grained controls over the ability to     use Dynamic DNS (DDNS) to update records in a zone,     BIND 9 provides a feature called update-policy. Various     rules can be configured to limit the types of updates     that can be performed by a client, depending on the key     used when sending the update request. Unfortunately,     some rule types were not initially documented, and when     documentation for them was added to the Administrator     Reference Manual (ARM) in change #3112, the language     that was added to the ARM at that time incorrectly     described the behavior of two rule types,     krb5-subdomain and ms-subdomain. This incorrect     documentation could mislead operators into believing     that policies they had configured were more restrictive     than they actually were. This affects BIND versions     prior to BIND 9.11.5 and BIND 9.12.3.(CVE-2018-5741)

  - An assertion failure was found in the way bind     implemented the 'managed keys' feature. An attacker     could use this flaw to cause the named daemon to crash.
    This flaw is very difficult for an attacker to trigger     because it requires an operator to have BIND configured     to use a trust anchor managed by the     attacker.(CVE-2018-5745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was found that bind does not implement reasonable     restrictions for zone sizes. This allows an explicitly     configured primary DNS server for a zone to crash a     secondary DNS server, affecting service of other zones     hosted on the same secondary server.(CVE-2016-6170)

  - Controls for zone transfers may not be properly applied     to Dynamically Loadable Zones (DLZs) if the zones are     writable Versions affected: BIND 9.9.0 -> 9.10.8-P1,     9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions     9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview     Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to     BIND 9.9.0 have not been evaluated for vulnerability to     CVE-2019-6465.(CVE-2019-6465)

  - To provide fine-grained controls over the ability to     use Dynamic DNS (DDNS) to update records in a zone,     BIND 9 provides a feature called update-policy. Various     rules can be configured to limit the types of updates     that can be performed by a client, depending on the key     used when sending the update request. Unfortunately,     some rule types were not initially documented, and when     documentation for them was added to the Administrator     Reference Manual (ARM) in change #3112, the language     that was added to the ARM at that time incorrectly     described the behavior of two rule types,     krb5-subdomain and ms-subdomain. This incorrect     documentation could mislead operators into believing     that policies they had configured were more restrictive     than they actually were. This affects BIND versions     prior to BIND 9.11.5 and BIND 9.12.3.(CVE-2018-5741)

  - 'managed-keys' is a feature which allows a BIND     resolver to automatically maintain the keys used by     trust anchors which operators configure for use in     DNSSEC validation. Due to an error in the managed-keys     feature it is possible for a BIND server which uses     managed-keys to exit due to an assertion failure if,     during key rollover, a trust anchor's keys are replaced     with keys which use an unsupported algorithm. Versions     affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1,     9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3     of BIND 9 Supported Preview Edition. Versions 9.13.0 ->     9.13.6 of the 9.13 development branch are also     affected. Versions prior to BIND 9.9.0 have not been     evaluated for vulnerability to     CVE-2018-5745.(CVE-2018-5745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - 'managed-keys' is a feature which allows a BIND     resolver to automatically maintain the keys used by     trust anchors which operators configure for use in     DNSSEC validation. Due to an error in the managed-keys     feature it is possible for a BIND server which uses     managed-keys to exit due to an assertion failure if,     during key rollover, a trust anchor's keys are replaced     with keys which use an unsupported algorithm. Versions     affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1,     9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3     of BIND 9 Supported Preview Edition. Versions 9.13.0 ->     9.13.6 of the 9.13 development branch are also     affected. Versions prior to BIND 9.9.0 have not been     evaluated for vulnerability to     CVE-2018-5745.(CVE-2018-5745)

  - Controls for zone transfers may not be properly applied     to Dynamically Loadable Zones (DLZs) if the zones are     writable Versions affected: BIND 9.9.0 -> 9.10.8-P1,     9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions     9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview     Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to     BIND 9.9.0 have not been evaluated for vulnerability to     CVE-2019-6465.(CVE-2019-6465)

  - ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1,     and 9.11.x through 9.11.0b1 allows primary DNS servers     to cause a denial of service (secondary DNS server     crash) via a large AXFR response, and possibly allows     IXFR servers to cause a denial of service (IXFR client     crash) via a large IXFR response and allows remote     authenticated users to cause a denial of service     (primary DNS server crash) via a large UPDATE     message.(CVE-2016-6170)

  - To provide fine-grained controls over the ability to     use Dynamic DNS (DDNS) to update records in a zone,     BIND 9 provides a feature called update-policy. Various     rules can be configured to limit the types of updates     that can be performed by a client, depending on the key     used when sending the update request. Unfortunately,     some rule types were not initially documented, and when     documentation for them was added to the Administrator     Reference Manual (ARM) in change #3112, the language     that was added to the ARM at that time incorrectly     described the behavior of two rule types,     krb5-subdomain and ms-subdomain. This incorrect     documentation could mislead operators into believing     that policies they had configured were more restrictive     than they actually were. This affects BIND versions     prior to BIND 9.11.5 and BIND 9.12.3.(CVE-2018-5741)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - To provide fine-grained controls over the ability to     use Dynamic DNS (DDNS) to update records in a zone,     BIND 9 provides a feature called update-policy. Various     rules can be configured to limit the types of updates     that can be performed by a client, depending on the key     used when sending the update request. Unfortunately,     some rule types were not initially documented, and when     documentation for them was added to the Administrator     Reference Manual (ARM) in change #3112, the language     that was added to the ARM at that time incorrectly     described the behavior of two rule types,     krb5-subdomain and ms-subdomain. This incorrect     documentation could mislead operators into believing     that policies they had configured were more restrictive     than they actually were. This affects BIND versions     prior to BIND 9.11.5 and BIND 9.12.3.(CVE-2018-5741)

  - 'managed-keys' is a feature which allows a BIND     resolver to automatically maintain the keys used by     trust anchors which operators configure for use in     DNSSEC validation. Due to an error in the managed-keys     feature it is possible for a BIND server which uses     managed-keys to exit due to an assertion failure if,     during key rollover, a trust anchor's keys are replaced     with keys which use an unsupported algorithm. Versions     affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1,     9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3     of BIND 9 Supported Preview Edition. Versions 9.13.0 ->     9.13.6 of the 9.13 development branch are also     affected. Versions prior to BIND 9.9.0 have not been     evaluated for vulnerability to     CVE-2018-5745.(CVE-2018-5745)

  - Controls for zone transfers may not be properly applied     to Dynamically Loadable Zones (DLZs) if the zones are     writable Versions affected: BIND 9.9.0 -> 9.10.8-P1,     9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions     9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview     Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to     BIND 9.9.0 have not been evaluated for vulnerability to     CVE-2019-6465.(CVE-2019-6465)

  - ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1,     and 9.11.x through 9.11.0b1 allows primary DNS servers     to cause a denial of service (secondary DNS server     crash) via a large AXFR response, and possibly allows     IXFR servers to cause a denial of service (IXFR client     crash) via a large IXFR response and allows remote     authenticated users to cause a denial of service     (primary DNS server crash) via a large UPDATE     message.(CVE-2016-6170)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - 'managed-keys' is a feature which allows a BIND     resolver to automatically maintain the keys used by     trust anchors which operators configure for use in     DNSSEC validation. Due to an error in the managed-keys     feature it is possible for a BIND server which uses     managed-keys to exit due to an assertion failure if,     during key rollover, a trust anchor's keys are replaced     with keys which use an unsupported algorithm. Versions     affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1,     9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3     of BIND 9 Supported Preview Edition. Versions 9.13.0 ->     9.13.6 of the 9.13 development branch are also     affected. Versions prior to BIND 9.9.0 have not been     evaluated for vulnerability to     CVE-2018-5745.(CVE-2018-5745)

  - ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1,     and 9.11.x through 9.11.0b1 allows primary DNS servers     to cause a denial of service (secondary DNS server     crash) via a large AXFR response, and possibly allows     IXFR servers to cause a denial of service (IXFR client     crash) via a large IXFR response and allows remote     authenticated users to cause a denial of service     (primary DNS server crash) via a large UPDATE     message.(CVE-2016-6170)

  - Controls for zone transfers may not be properly applied     to Dynamically Loadable Zones (DLZs) if the zones are     writable Versions affected: BIND 9.9.0 -> 9.10.8-P1,     9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions     9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview     Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to     BIND 9.9.0 have not been evaluated for vulnerability to     CVE-2019-6465.(CVE-2019-6465)

  - To provide fine-grained controls over the ability to     use Dynamic DNS (DDNS) to update records in a zone,     BIND 9 provides a feature called update-policy. Various     rules can be configured to limit the types of updates     that can be performed by a client, depending on the key     used when sending the update request. Unfortunately,     some rule types were not initially documented, and when     documentation for them was added to the Administrator     Reference Manual (ARM) in change #3112, the language     that was added to the ARM at that time incorrectly     described the behavior of two rule types,     krb5-subdomain and ms-subdomain. This incorrect     documentation could mislead operators into believing     that policies they had configured were more restrictive     than they actually were. This affects BIND versions     prior to BIND 9.11.5 and BIND 9.12.3.(CVE-2018-5741)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the installation of ISC BIND running on the remote name server is affected by a memory exhaustion vulnerability. A server is potentially vulnerable if it accepts zone data from another source, as no limit is currently placed on zone data size.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion.

CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64.

CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure.

CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response.
IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message.

CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

One additional non-security bug was fixed :

The default umask was changed to 077. (bsc#1020983)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for bind fixes the following security issues:
CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64.
CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528):
When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol. One additional non-security bug was fixed: The default umask was changed to 077. (bsc#1020983)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-6170

----

Security fix for CVE-2016-8864

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Allow zone size limit (CVE-2016-6170)

----

Security fix for CVE-2016-8864

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201610-07 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition through       multiple attack vectors.
  Workaround :

    There is no known workaround at this time.

ISC reports :

DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from sources that are not fully trusted (for example: providers of secondary name service). A party who is allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS updates) can overwhelm the server which is accepting data by intentionally or accidentally exhausting that server's memory.

ID	Name	Product	Family	Severity
168280	Ubuntu 16.04 ESM : Bind vulnerabilities (USN-5747-1)	Nessus	Ubuntu Local Security Checks	medium
135622	EulerOS Virtualization 3.0.2.2 : bind (EulerOS-SA-2020-1460)	Nessus	Huawei Local Security Checks	medium
134492	EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2020-1203)	Nessus	Huawei Local Security Checks	medium
132274	EulerOS 2.0 SP3 : bind (EulerOS-SA-2019-2557)	Nessus	Huawei Local Security Checks	medium
131607	EulerOS 2.0 SP2 : bind (EulerOS-SA-2019-2453)	Nessus	Huawei Local Security Checks	medium
130837	EulerOS 2.0 SP5 : bind (EulerOS-SA-2019-2128)	Nessus	Huawei Local Security Checks	medium
106679	ISC BIND Zone Data Denial of Service	Nessus	DNS	medium
99499	openSUSE Security Update : bind (openSUSE-2017-491)	Nessus	SuSE Local Security Checks	high
99358	SUSE SLES11 Security Update : bind (SUSE-SU-2017:1000-1)	Nessus	SuSE Local Security Checks	high
99357	SUSE SLES12 Security Update : bind (SUSE-SU-2017:0999-1)	Nessus	SuSE Local Security Checks	high
99356	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2017:0998-1)	Nessus	SuSE Local Security Checks	high
95305	Fedora 23 : bind99 (2016-8e39076950)	Nessus	Fedora Local Security Checks	high
95003	Fedora 25 : bind99 (2016-567a5591e4)	Nessus	Fedora Local Security Checks	high
94926	Fedora 24 : bind99 (2016-9417b4c1dc)	Nessus	Fedora Local Security Checks	high
93994	GLSA-201610-07 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
92832	FreeBSD : BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers (7d08e608-5e95-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-6170

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high