ISC BIND 9 DNSSEC NSEC/NSEC3 Bogus NXDOMAIN Responses
Medium Nessus Plugin ID 44116
SynopsisThe remote name server is affected by a cache poisoning vulnerability.
DescriptionAccording to its version number, the remote installation of BIND suffers from a cache poisoning vulnerability. The vulnerability exists due to an error in DNSSEC NSEC/NSEC3 validation code which could cause caching of bogus NXDOMAIN responses without correctly validating them. This issue affects all versions prior to 9.4.3-P5, 9.5.2-P2, 9.6.1-P3 or pre-releases of 9.7.0.
Note that only nameservers that allow recursive queries and validate DNSSEC records are affected. Nessus has tried to verify if the remote service supports DNSSEC options, but has not verified if the remote service allows recursive queries, so this could be a false positive.
SolutionUpgrade to BIND 9.4.3-P5, 9.5.2-P2 or 9.6.1-P3 or later.
Note that fixes for 9.7.0 pre-releases are not available as of 2010/01/22.