Detections
Analytics
Alpine: bind: security update to 9.16.4-r0
medium Tenable Self-Hosted Container Security Plugin ID 403668
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An attacker who is permitted to send zone data to a server via zone transfer can exploit this to
intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.
(CVE-2020-8618)
- In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND
Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service
for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk
("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone
content could theoretically introduce such a record in order to exploit this condition to cause denial of
service, though we consider the use of this vector unlikely because any such attack would require a
significant privilege level and be easily traceable. (CVE-2020-8619)
See Also
Plugin Details
Severity: Medium
ID: 403668
Version: Revision 1.28
Type: Local
Published: 10/31/2023
Updated: 9/15/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 95.09
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS Score Source: CVE-2020-8619
CVSS v3
Risk Factor: Medium
Base Score: 4.9
Temporal Score: 4.3
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 6/10/2020
Reference Information
CVE: CVE-2020-8618, CVE-2020-8619
IAVA: 2020-A-0276-S