Detections
Analytics
Amazon Linux AMI : bind (ALAS-2015-631)
medium Nessus Plugin ID 87380
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
An error in the parsing of incoming responses allows some records with an incorrect class to be be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. Intentional exploitation of this condition is possible and could be used as a denial-of-service vector against servers performing recursive queries. (CVE-2015-8000)CVE-2015-8461 was also issued today for bind, but the Amazon Linux AMI's version of bind is not impacted by that CVE.
Solution
Run 'yum update bind' to update your system.See Also
Plugin Details
Severity: Medium
ID: 87380
File Name: ala_ALAS-2015-631.nasl
Version: 2.6
Type: Local
Agent: unix
Published: 12/16/2015
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:bind, p-cpe:/a:amazon:linux:bind-chroot, p-cpe:/a:amazon:linux:bind-debuginfo, p-cpe:/a:amazon:linux:bind-devel, p-cpe:/a:amazon:linux:bind-libs, p-cpe:/a:amazon:linux:bind-sdb, p-cpe:/a:amazon:linux:bind-utils
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 12/15/2015
Reference Information
CVE: CVE-2015-8000