SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bind (SUSE-SU-2023:2667-1)

high Nessus Plugin ID 177730

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2667-1 advisory.

Update to release 9.16.42

Security Fixes:

* The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the configured max-cache-size limit. (CVE-2023-2828)
* A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911)

Bug Fixes:

* Previously, it was possible for a delegation from cache to be returned to the client after the stale-answer-client-timeout duration. This has been fixed. [bsc#1212544, bsc#1212567, jsc#SLE-24600]

Update to release 9.16.41

Bug Fixes:

* When removing delegations from an opt-out range, empty-non-terminal NSEC3 records generated by those delegations were not cleaned up. This has been fixed. [jsc#SLE-24600]

Update to release 9.16.40

Bug Fixes:

* Logfiles using timestamp-style suffixes were not always correctly removed when the number of files exceeded the limit set by versions. This has been fixed for configurations which do not explicitly specify a directory path as part of the file argument in the channel specification.
* Performance of DNSSEC validation in zones with many DNSKEY records has been improved.

Update to release 9.16.39

Feature Changes:

* libuv support for receiving multiple UDP messages in a single recvmmsg() system call has been tweaked several times between libuv versions 1.35.0 and 1.40.0; the current recommended libuv version is 1.40.0 or higher. New rules are now in effect for running with a different version of libuv than the one used at compilation time. These rules may trigger a fatal error at startup:
- Building against or running with libuv versions 1.35.0 and 1.36.0 is now a fatal error.
- Running with libuv version higher than 1.34.2 is now a fatal error when named is built against libuv version 1.34.2 or lower.
- Running with libuv version higher than 1.39.0 is now a fatal error when named is built against libuv version 1.37.0, 1.38.0, 1.38.1, or 1.39.0.

* This prevents the use of libuv versions that may trigger an assertion failure when receiving multiple UDP messages in a single system call.

Bug Fixes:

* named could crash with an assertion failure when adding a new zone into the configuration file for a name which was already configured as a member zone for a catalog zone. This has been fixed.
* When named starts up, it sends a query for the DNSSEC key for each configured trust anchor to determine whether the key has changed. In some unusual cases, the query might depend on a zone for which the server is itself authoritative, and would have failed if it were sent before the zone was fully loaded.
This has now been fixed by delaying the key queries until all zones have finished loading. [jsc#SLE-24600]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected bind, bind-doc, bind-utils and / or python3-bind packages.

Plugin Details

Severity: High

ID: 177730

File Name: suse_SU-2023-2667-1.nasl

Version: 1.6

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 6/29/2023

Updated: 6/26/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-2911

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2023-2911

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:python3-bind, p-cpe:/a:novell:suse_linux:bind-utils, p-cpe:/a:novell:suse_linux:bind, p-cpe:/a:novell:suse_linux:bind-doc, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 6/28/2023

Vulnerability Publication Date: 6/21/2023

Reference Information

CVE: CVE-2023-2828, CVE-2023-2911

IAVA: 2023-A-0320-S

SuSE: SUSE-SU-2023:2667-1

Detections

Analytics