SynopsisThe remote name server is affected by a cache poisoning vulnerability.
DescriptionAccording to its version number, the remote installation of BIND suffers from a cache poisoning vulnerability. The vulnerability exists due to an error in DNSSEC NSEC/NSEC3 validation code which could cause caching of bogus NXDOMAIN responses without correctly validating them. This issue affects all versions prior to 9.4.3-P5, 9.5.2-P2, 9.6.1-P3 or pre-releases of 9.7.0.
Note that only nameservers that allow recursive queries and validate DNSSEC records are affected. Nessus has tried to verify if the remote service supports DNSSEC options, but has not verified if the remote service allows recursive queries, so this could be a false positive.
SolutionUpgrade to BIND 9.4.3-P5, 9.5.2-P2 or 9.6.1-P3 or later.
Note that fixes for 9.7.0 pre-releases are not available as of 2010/01/22.
File Name: bind9_bogus_nxdomain_caching.nasl
Configuration: Enable paranoid mode
Required KB Items: Settings/ParanoidReport, bind/version
Exploit Ease: No known exploits are available
Patch Publication Date: 1/19/2010
Vulnerability Publication Date: 1/19/2010