Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that     would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional     ACL restrictions are set, because of an improper TSIG validity period check. (CVE-2017-11104)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that
    would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional
    ACL restrictions are set, because of an improper TSIG validity period check. (CVE-2017-11104)

This update for knot fixes the following issues :

  - CVE-2017-11104: Fixed an improper implementation of TSIG     protocol which could have allowed an attacker with a     valid key name and algorithm to bypass TSIG     authentication (boo#1047841).

This update for knot fixes the following issues :

  - CVE-2017-11104: Knot DNS contained a flaw within the     TSIG protocol implementation that would allow an     attacker with a valid key name and algorithm to bypass     TSIG authentication if no additional ACL restrictions     are set, because of an improper TSIG validity period     check. (boo#1047841)

The Knot DNS server running on the remote host is version 2.4.x prior to 2.4.5 or 2.5.x prior to 2.5.2. It is, therefore, affected by a TSIG authentication bypass vulnerability.

New upstream release: 2.4.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Clement Berthaux from Synaktiv discovered a signature forgery vulnerability in knot, an authoritative-only DNS server. This vulnerability allows an attacker to bypass TSIG authentication by sending crafted DNS packets to a server.

ID	Name	Product	Family	Severity
254488	Linux Distros Unpatched Vulnerability : CVE-2017-11104	Nessus	Misc.	medium
405078	Alpine: knot: security update to 2.4.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405078	Alpine: knot: security update to 2.4.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
139014	openSUSE Security Update : knot (openSUSE-2020-1086)	Nessus	SuSE Local Security Checks	medium
139013	openSUSE Security Update : knot (openSUSE-2020-1085)	Nessus	SuSE Local Security Checks	medium
110067	openSUSE Security Update : knot (openSUSE-2018-494)	Nessus	SuSE Local Security Checks	medium
106196	Knot DNS 2.4.x < 2.4.4 / 2.5.x < 2.5.2 TSIG Authentication Bypass Vulnerability (CVE-2017-11104)	Nessus	DNS	medium
101871	Fedora 26 : knot (2017-d3d38a53f9)	Nessus	Fedora Local Security Checks	medium
101555	Debian DSA-3910-1 : knot - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-11104

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium