The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6633-1 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -     `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918     address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9     versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through     9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

  - A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions     9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,     and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

  - MITRE: CVE-2023-50387 DNSSEC verification complexity can be exploited to exhaust CPU resources and stall     DNS resolvers (CVE-2023-50387)

  - The processing of responses coming from DNSSEC-signed zones using NSEC3 can cause CPU exhaustion on a     DNSSEC-validating resolver.By flooding the target resolver with queries exploiting this flaw an attacker     can significantly impair the resolver's performance, effectively denying legitimate clients access to the     DNS resolution service. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 22.04 LTS / 23.10 : Bind vulnerabilities (USN-6633-1)

high Nessus Plugin ID 190450

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.2 Feb 16, 2024, 7:23 PM IAVM reference Plugin Feed: 202402161923
Version 1.1 Feb 14, 2024, 6:22 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202402140622
Version 1.1 Feb 16, 2024, 12:17 PM IAVM reference Plugin Feed: 202402161217
Version 1.0 Feb 14, 2024, 3:36 AM Detection (updated detection logic) New Plugin metadata Plugin Feed: 202402140336