According to its self-reported version number, the instance of ISC BIND 9 running on the remote name server is 9.9.x prior to 9.9.9-P5 or 9.9.9-S7, 9.10.x prior to 9.10.4-P5, or 9.11.x prior to 9.11.0-P2. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in named due to     a flaw that is triggered during the handling of a     specially crafted answer packet in a response to an     RTYPE ANY query. An unauthenticated, remote attacker can     exploit this to cause an assertion failure and daemon     exit. Note that this vulnerability affects versions     9.4.0 to 9.6-ESV-R11-W1, 9.8.5 to 9.8.8, 9.9.3 to     9.9.9-P4, 9.9.9-S1 to 9.9.9-S6, 9.10.0 to 9.10.4-P4, and     9.11.0 to 9.11.0-P1. (CVE-2016-9131)

  - A denial of service vulnerability exists in named in     DNSSEC-enabled authoritative servers that is triggered     during the handling of a query response that contains     inconsistent DNSSEC information. An unauthenticated,     remote attacker can exploit this to cause an assertion     failure and daemon exit. Note that this vulnerability     affects versions 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and     9.11.0-P1. (CVE-2016-9147)

  - A denial of service vulnerability exists in named due to     a flaw that is triggered during the handling of a     specially crafted answer that contains a DS resource     record. An unauthenticated, remote attacker can exploit     this to cause an assertion failure and daemon exit. Note     that this vulnerability affects versions 9.6-ESV-R9 to     9.6-ESV-R11-W1, 9.8.5 to 9.8.8, 9.9.3 to 9.9.9-P4,     9.9.9-S1 to 9.9.9-S6, 9.10.0 to 9.10.4-P4, and 9.11.0 to     9.11.0-P1. (CVE-2016-9444)

  - A denial of service vulnerability exists in named in the     nxdomain-redirect functionality that is triggered when     handling a specially crafted query. An unauthenticated,     remote attacker can exploit this to cause a REQUIRE     assertion failure and daemon exit. Note that this     vulnerability affects versions 9.9.8-S1 to 9.9.8-S3,     9.9.9-S1 to 9.9.9-S6, and 9.11.0-9.11.0 to P1.
    (CVE-2016-9778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is 9.x prior to 9.9.9-P3. It is, therefore, affected by a denial of service vulnerability when handling malformed options sections. An unauthenticated, remote attacker can exploit this, via a specially crafted OPT resource record, to cause an assertion failure, resulting in a daemon exit.

According to its self-reported version number, the instance of ISC BIND 9 running on the remote name server is affected by a denial of service vulnerability due to improper handling of a recursive response containing a DNAME record in the answer section. An unauthenticated, remote attacker can exploit this to cause an assertion failure and daemon exit.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of ISC BIND running on the remote name server is 9.9.x prior to 9.9.9-P3, 9.10.x prior to 9.10.4-P3, or 9.11.x prior to 9.11.0rc3. It is, therefore, affected by a denial of service vulnerability within file buffer.c due to improper construction of responses to crafted requests. An unauthenticated, remote attacker can exploit this, via a specially crafted query, to cause an assertion failure, resulting in a daemon exit.

According to its self-reported version number, the installation of ISC BIND running on the remote name server is 9.x prior to 9.9.9-P2, 9.10.x prior to 9.10.4-P2, or 9.11.0a3 prior to 9.11.0b2. It is, therefore, affected by an error in the lightweight resolver (lwres) protocol implementation when resolving a query name that, when combined with a search list entry, exceeds the maximum allowable length. An unauthenticated, remote attacker can exploit this to cause a segmentation fault, resulting in a denial of service condition. This issue occurs when lwresd or the the named 'lwres' option is enabled.

The Microsoft DNS server running on the remote host has inverse query functionality enabled. It is, therefore, affected by a buffer over-read error in the dns.exe!answerIQuery() function due to a failure to correctly parse the Resource Record in an inverse query packet. An unauthenticated, remote attacker can exploit this to cause a denial of service or to disclose information.

According to its self-reported version number, ISC BIND installed on the remote name server is affected by a denial of service vulnerability in file resolver.c when DNS cookies are enabled. An unauthenticated, remote attacker can exploit his, via a malformed packet with more than one cookie option, to cause an INSIST assertion failure and daemon exit.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in files     resolver.c and db.c when handling DNAME resource     signatures. An unauthenticated, remote attacker can     exploit this, via a crafted query that generates a     response containing a signature record, to cause an     assertion failure and daemon exit. (CVE-2016-1286)

  - A denial of service vulnerability exists in resolver.c     when DNS cookies are enabled. An unauthenticated, remote     attacker can exploit this, via a malformed cookie with     more than one cookie option, to cause an INSIST     assertion failure and daemon exit. (CVE-2016-2088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in files     sexpr.c and alist.c when handling control channel     packets. An unauthenticated, remote attacker can     exploit this, via crafted packets sent to the control     channel (rndc) interface, to cause an assertion failure     and daemon exit. (CVE-2016-1285)

  - A denial of service vulnerability exists in resolver.c     when DNS cookies are enabled. An unauthenticated, remote     attacker can exploit this, via a malformed cookie with     more than one cookie option, to cause an INSIST     assertion failure and daemon exit. (CVE-2016-2088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of BIND 9 Supported Preview Edition running on the remote host is version 9.9.8-Sx prior to 9.9.8-S5. It is, therefore, affected by a denial of service vulnerability due to a flaw in file rdataset.c related to handling flag values in incoming queries when the 'nxdomain-redirect' option is enabled. An unauthenticated, remote attacker can exploit this, via a crafted query with the right combination of attributes, to cause a REQUIRE assertion failure, resulting in termination of the service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Note that 9.9.8-S4 and 9.9.8-S5 are preview versions of BIND provided exclusively to ISC Support customers.

According to its self-reported version number, the installation of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists due to improper     handling of certain string formatting options. An     authenticated, remote attacker can exploit this, via a     malformed Address Prefix List (APL) record, to cause an     INSIST assertion failure and daemon exit.
    (CVE-2015-8704)

  - A denial of service vulnerability exists due to a     failure to properly convert OPT records and ECS options     to formatted text. A remote attacker can exploit this     to cause a REQUIRE assertion failure and daemon exit.
    Note that this issue only affects BIND 9.10.x.
    (CVE-2015-8705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Knot DNS server running on the remote host is version 1.6.x prior to 1.6.6 or 2.0.x prior to 2.0.2. It is, therefore, affected by an out-of-bounds read error that occurs when parsing malformed NAPTR records. An unauthenticated, remote attacker can exploit this to disclose memory contents or crash the knotd daemon, resulting in a denial of service.

According to its self-reported version number, the installation of PowerDNS running on the remote name server is 2.x or earlier. It is, therefore, no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.7.3. It is, therefore, affected by a denial of service vulnerability due to improper validation of user-supplied input when handling self-referential names during label decompression. An unauthenticated, remote attacker can exploit this vulnerability, via crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.6.2. It is, therefore, affected by a denial of service vulnerability due to the lack of limiting delegation chaining. A remote attacker can exploit this vulnerability, via a large or infinite number of referrals, to cause resource exhaustion, resulting in a denial of service condition.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.1.7.2. It is, therefore, affected by multiple vulnerabilities :

  - A buffer overflow condition exists that allows a remote   	attacker, via crafted packets, to cause a daemon crash,   	resulting in a denial of service condition.
  	(CVE-2009-4009)

  - An unspecified flaw exists that allows a remote attacker   	to spoof DNS data via crafted zones. (CVE-2009-4010)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.1.4. It is, therefore, affected by multiple vulnerabilities :

  - A buffer overflow condition exists that allows a remote   	attacker, via a specially crafted TCP DNS query, to   	prevent the Recursor from properly calculating the TCP   	DNS query length, resulting in a denial of service   	condition. (CVE-2006-4251)

  - A denial of service vulnerability exists that allows a   	remote attacker, via a CNAME record with a zero TTL, to   	cause a resource exhaustion, resulting in an application   	crash. (CVE-2006-4252)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patches or a workaround.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.0.1. It is, therefore, affected by a denial of service vulnerability due to improper processing of Extension Mechanisms for DNS (EDNS0) packets. A remote attacker can exploit this vulnerability, via specially crafted EDNS0 packets, to cause an application crash, resulting in a denial of service condition.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS Authoritative Server listening on the remote host is version 3.4.4, 3.4.5, or 3.4.6. It is, therefore, affected by a denial of service vulnerability due to an assertion flaw that is triggered when handling malformed packets. An unauthenticated, remote attacker can exploit this vulnerability, via crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS Authoritative Server listening on the remote host is version 3.x prior to 3.4.5. It is, therefore, affected by a denial of service vulnerability due to improper validation of user-supplied input when handling self-referential names during label decompression. An unauthenticated, remote attacker can exploit this, via specially crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS service listening on the remote host is prior to 2.9.18. It is, therefore, affected by multiple vulnerabilities : 

  - A flaw exists due to improper escaping of LDAP queries.
  	A remote attacker can exploit this to cause a denial of   	service condition or to conduct LDAP injection attacks.
  	(CVE-2005-2301)

  - A denial of service vulnerability exists when allowing   	recursion to a restricted range of IP addresses due to   	improper handling of questions from clients that are   	denied a recursion. An attacker can exploit this to   	prevent answers to those clients that are allowed to use   	recursion. (CVE-2005-2302)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of the PowerDNS service listening on the remote host is prior to 2.9.17. It is, therefore, affected by multiple denial of service vulnerabilities : 

  - A denial of service vulnerability exists due to a flaw   	that is triggered when the server receives a compressed   	DNS packet with a label length byte with an incorrect   	offset. A remote attacker can exploit this to trigger an   	infinite loop, resulting in a denial of service   	condition. (CVE-2005-0038)

  - An unspecified flaw exists in the DNSPacket::expand()   	method in dnspacket.cc. A emote attacker can exploit   	flaw, by sending a random stream of bytes, to cause a   	denial of service condition. (CVE-2005-0428)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote host is running the Unbound DNS resolver. 

Note that the version detected is not necessarily accurate and could even be forged, as some DNS servers send the information based on a configuration file.

According to its self-reported version number, the remote Unbound DNS resolver is affected by an unspecified DNSSEC validation weakness that is triggered when an upstream server with different trust anchors introduces unsigned records in messages.

According to its self-reported version number, the remote Unbound DNS resolver is affected by a denial of service vulnerability in the Domain Name Service due to improper handling of a maliciously-constructed zone or queries from a rogue server. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause the service to issue unlimited queries in an attempt to follow a delegation, resulting in a denial of service condition.

According to its self-reported version number, the remote Unbound DNS resolver is affected by a ghost domain names vulnerability due to the resolver service overwriting cached name servers and TTL values in NS records while processing the response of an A record query. A remote attacker can exploit this to resume the resolving of revoked domain names.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of Knot DNS prior to 1.6.3. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the     knot_rrset_rr_to_canonical() function. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet, to disclose sensitive     information or cause a denial of service.

  - An out-of-bounds read error exists in the zone parser     due to improper handling of origin domain names. An     unauthenticated, remote attacker can exploit this, via a     specially crafted zone, to disclose sensitive     information or cause a denial of service.

  - An out-of-bounds read error exists in the rdata_seek()     function. An unauthenticated, remote attacker can     exploit this, via a specially crafted packet, to     disclose sensitive information or cause a denial of     service.

The remote dnsmasq server is running a version prior to 2.73rc4. It is, therefore, affected by an information disclosure vulnerability due not properly checking the return value from the setup_reply() function during TCP connections. An unauthenticated, remote attacker can exploit this to disclose sensitive information.

The remote dnsmasq server is running a version prior to 2.66test2. It is, therefore, affected by a denial of service vulnerability in libvirtd due to improper parsing of malformed network packets. An unauthenticated, remote attacker can exploit this to cause an amplification of a large amount of DNS queries, resulting in a denial of service condition.

Note that this vulnerability exists due to an incomplete fix for CVE-2012-3411.

The remote dnsmasq server is running a version prior to 2.63test1. It is, therefore, affected by a denial of service vulnerability in libvirtd due to improper parsing of malformed network packets. An unauthenticated, remote attacker can exploit this to cause an amplification of a large amount of DNS queries, resulting in a denial of service condition.

The remote dnsmasq server is running version 2.73rc6 or 2.73rc7. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the extract_name() function in rfc1035.c that occurs due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service or the execution of arbitrary code.

According to its self-reported version number, the remote installation of BIND is affected by a denial of service vulnerability due to a race condition that occurs when handling socket errors. An unauthenticated, remote attacker can exploit this to trigger an INSIST failure, resulting in a denial of service condition.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND is affected by a denial of service vulnerability due to improper parsing of incorrect class attributes in db.c. An unauthenticated, remote attacker can exploit this, via a malformed class attribute, to trigger a REQUIRE assertion failure, resulting in a denial of service condition.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of the PowerDNS Authorative Server listening on the remote host is version 3.4.x prior to 3.4.6. It is, therefore, affected by a denial of service vulnerability due to an unspecified flaw in 'pdns/distributor.hh' related to DNS packet parsing and generation. A remote attacker can exploit this vulnerability, via crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch or the workaround.

According to its self-reported version number, the MaraDNS server running on the remote host is prior to 2.0.13. It is, therefore, potentially affected by multiple vulnerabilities :

  - A flaw exists in mararc parser due to a buffer underflow     condition in the file ParseMaraRc.c. An unauthenticated,     remote attacker can exploit this to read from disallowed     memory locations.

  - A flaw exists in the Deadwood recursive resolver     component due to a buffer underflow condition that can     allow an out-of-bounds memory location to be overwritten     by the output of malloc(). An unauthenticated, remote     attacker can exploit this issue to cause a denial of     service.

According to its self-reported version number, the installation of ISC BIND running on the remote name server is 9.8.x or earlier. It is, therefore, no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

According to its self-reported version number, the installation of ISC BIND running on the remote name server is potentially affected by the following vulnerabilities :

  - A denial of service vulnerability exists due to an     assertion flaw that is triggered when parsing malformed     DNSSEC keys. An unauthenticated, remote attacker can     exploit this, via a specially crafted query to a zone     containing such a key, to cause a validating resolver to     exit. (CVE-2015-5722)

  - A denial of service vulnerability exists in the     fromwire_openpgpkey() function in openpgpkey_61.c that     is triggered when the length of data is less than 1. An     unauthenticated, remote attacker can exploit this, via a     specially crafted response to a query, to cause an     assertion failure that terminates named. (CVE-2015-5986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the installation of ISC BIND on the remote name server is potentially affected by a denial of service vulnerability due to a REQUIRE assertion flaw that occurs while handling TKEY queries. A remote attacker can exploit this by using a specially crafted TKEY query to crash the daemon.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND is potentially affected by a denial of service vulnerability, when configured as a recursive resolver with DNSSEC validation, due to an error that occurs during the validation of specially crafted zone data returned in an answer to a recursive query. A remote attacker can exploit this, by causing a query to be performed against a maliciously constructed zone, to crash the resolver.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND is potentially affected by multiple vulnerabilities :

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND is potentially affected by a denial of service vulnerability due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND (via DNSco) is potentially affected by a denial of service vulnerability due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND is potentially affected by multiple vulnerabilities :

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - Multiple flaws exist with GeoIP functionality. These     flaws allow a remote attacker to cause a denial of     service. Note that these issues only affect the 9.10.x     branch. (CVE-2014-8680)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - An error exists related to handling the     'geoip-directory' option in named.conf when running     'rndc reconfig' or 'rndc reload' that allows connections     by unintended clients.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote installation of BIND is affected by multiple denial of service vulnerabilities :

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     could potentially cause the service to issue unlimited     queries leading to resource exhaustion. (CVE-2014-8500)

  - Multiple flaws exist with the GeoIP feature. These flaws     could allow a remote attacker to cause a denial of     service. Note these issues only affect the 9.10.x     branch. (CVE-2014-8680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running Knot DNS version 1.5.2. It is, therefore, affected by an error that could allow certain Incremental Zone Transfer (IXFR) messages to crash the server.

According to its self-reported version number, the version of the PowerDNS Recursor service listening on the remote host is version 3.6.0. It is, therefore, affected by a denial of service vulnerability due to improper handling of malformed packet sequences. An unauthenticated, remote attacker can exploit this to crash the application, resulting in a denial of service condition.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch or the workaround.

The remote host is running a version of Knot DNS prior to 1.4.5. It is, therefore, affected by an unspecified vulnerability in the TSIG validation code that may allow spoofing attacks due to improper TSIG signature verification.

Nessus was able to obtain version information from the remote Knot DNS server by sending a special TXT record query to the remote host.

Nessus detected a version of Microsoft DNS server listening on the remote host that belongs to an unsupported version of Windows.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

ID	Name	Severity
96625	ISC BIND 9 < 9.9.9-P5 / 9.9.9-S7 / 9.10.4-P5 / 9.11.0-P2 Multiple DoS	Medium
94611	ISC BIND 9.x < 9.9.9-P3 Options Sections DoS	Medium
94577	ISC BIND 9 Recursive Response DNAME Record Handling DoS	Medium
93865	ISC BIND 9.9.x < 9.9.9-P3 / 9.10.x < 9.10.4-P3 / 9.11.x < 9.11.0rc3 buffer.c Query Response DoS	High
92493	ISC BIND 9.x < 9.9.9-P2 / 9.10.x < 9.10.4-P2 / 9.11.0a3 < 9.11.0b2 lwres Query DoS	Medium
90149	Microsoft DNS Server Inverse Query Buffer Over-Read	Medium
90000	ISC BIND 9 resolver.c Multiple DNS Cookie Packet Handling DoS	Medium
89999	ISC BIND 9 Multiple DoS	Medium
89998	ISC BIND 9 Multiple DoS	Medium
88716	ISC BIND 9.9.8-Sx < 9.9.8-S5 REQUIRE Assertion DoS	Low
88385	ISC BIND 9.3.0 < 9.9.8-P3 / 9.9.x-Sx < 9.9.8-S4 / 9.10.x < 9.10.3-P3 Multiple DoS	Medium
87965	Knot DNS 1.6.x < 1.6.6 / 2.0.x < 2.0.2 NAPTR Record DoS	Medium
87953	PowerDNS Unsupported Version Detection	Critical
87952	PowerDNS Recursor 3.x < 3.7.3 Label Decompression DoS	High
87951	PowerDNS Recursor 3.x < 3.6.2 Recursive Referral Handling DoS	Medium
87950	PowerDNS Recursor 3.x < 3.1.7.2 Multiple Vulnerabilities	Critical
87949	PowerDNS Recursor 3.x < 3.1.4 Multiple Vulnerabilities	High
87948	PowerDNS Recursor 3.x < 3.0.1 EDNS0 DoS	Medium
87947	PowerDNS Authoritative Server 3.4.4 / 3.4.5 / 3.4.6 Process Packet Handling DoS	Medium
87946	PowerDNS Authoritative Server 3.x < 3.4.5 Label Decompression Self-Referential Name Handling DoS	High
87945	PowerDNS < 2.9.18 Multiple Vulnerabilities	Medium
87944	PowerDNS < 2.9.17 Multiple DoS	Medium
87872	Unbound DNS Resolver Remote Version Detection	Info
87871	Unbound < 1.5.2 Upstream Server Trust Anchor Unspecified DNSSEC Validation Weakness	Medium
87870	Unbound < 1.5.1 Delegation Handling Recursive Referral Handling Resource Exhaustion DoS	Medium
87869	Unbound < 1.4.11 Cache Update Policy Deleted Domain Name Resolving Weakness	Medium
87598	Knot DNS < 1.6.3 Multiple Vulnerabilities	High
87596	dnsmasq < 2.73rc4 setup_reply() Function Return Value Checking Information Disclosure	Medium
87595	dnsmasq < 2.66test2 libvirtd TCP Network Packet Parsing Response DNS Amplification DoS	Medium
87594	dnsmasq < 2.63test1 libvirtd TCP Network Packet Parsing Response DNS Amplification DoS	Medium
87593	dnsmasq 2.73rc6 < 2.73rc8 extract_name() Function RCE	Critical
87503	ISC BIND 9.9.8 < 9.9.8-P2 / 9.10.3 < 9.10.3-P2 Socket Error Handling DoS	High
87502	ISC BIND 9.x < 9.9.8-P2 / 9.10.x < 9.10.3-P2 Response Parsing Class Attribute Handling DoS	Medium
86699	PowerDNS Authoritative Server 3.4.x < 3.4.6 distributor.hh Packet Handling DoS	High
86674	MaraDNS < 2.0.13 Multiple Vulnerabilities	High
86072	ISC BIND Unsupported Version Detection	Critical
85896	ISC BIND 9.0.x < 9.9.7-P3 / 9.10.x < 9.10.2-P4 Multiple DoS	High
85241	ISC BIND 9.7.x < 9.9.7-P2 / 9.10.x < 9.10.2-P3 TKEY Query Handling Remote DoS	High
84728	ISC BIND 9.7.x < 9.9.7-P1 / 9.10.x < 9.10.2-P2 Resolver DNSSEC Validation DoS	High
81490	ISC BIND 9.9.7.x < 9.9.7rc2 Multiple Vulnerabilities	High
81489	ISC BIND 9.7.0.x < 9.9.6-P2 DNSSEC Validation DoS	Medium
81488	ISC BIND 9.9.6-S2 DNSSEC Validation DoS	Medium
81487	ISC BIND 9.10.2 < 9.10.2rc2 Multiple Vulnerabilities	High
81486	ISC BIND 9.10.x < 9.10.1-P2 DNSSEC Validation DoS	Medium
79861	ISC BIND 9 Multiple DoS Vulnerabilities	High
78890	Knot DNS 1.5.2 Incremental Zone Transfer (IXFR) DoS	Medium
77780	PowerDNS Recursor 3.6.0 Packet Sequence Handling DoS	Medium
76799	Knot DNS < 1.4.5 TSIG Signature Spoofing	Medium
76798	Knot DNS Server Version Detection	Info
74496	Unsupported Microsoft DNS Server Detection	Critical

DNS Family for Nessus