It was possible to determine that the remote name server is running BIND 9.x by querying it for the AUTHORS map.

The remote BIND server, according to its version number, is affected by various buffer overflow vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.

The remote name server allows DNS zone transfers to be performed. 

A zone transfer lets a remote attacker instantly populate a list of potential targets.  In addition, companies often use a naming convention that can give hints as to a servers primary application (for instance, proxy.example.com, payroll.example.com, b2b.example.com, etc.). 

As such, this information is of great use to an attacker, who may use it to gain information about the topology of the network and spot new targets.

The remote BIND server, according to its version number, is vulnerable to the 'ZXFR bug' that could allow an attacker to crash this service remotely.

It is possible to query the remote name server for third-party names.

If this is your internal nameserver, then the attack vector may be limited to employees or guest access if allowed.

If you are probing a remote nameserver, then it allows anyone to use it to resolve third party names (such as www.nessus.org).
This allows attackers to perform cache poisoning attacks against this nameserver.

If the host allows these recursive queries via UDP, then the host can be used to 'bounce' Denial of Service attacks against another network or system.

The remote BIND server, according to its version number, is vulnerable to several attacks that could allow an attacker to execute arbitrary code on the remote host.

The remote host is running BIND or another DNS server that reports its version number when it receives a special request for the text 'version.bind' in the domain 'chaos'. 

This version is not necessarily accurate and could even be forged, as some DNS servers send the information based on a configuration file.

We could make the remote DNS server crash by flooding it with characters. It is likely a WindowsNT DNS server.

Crashing the DNS server could allow an attacker to make your network non-functional, or even to use some DNS spoofing techniques to gain privileges on the network.

ID	Name	Severity
10728	ISC BIND 9.x AUTHORS Map Remote Version Disclosure	info
10605	ISC BIND < 4.9.8 / 8.2.3 Multiple Remote Overflows	critical
10595	DNS Server Zone Transfer Information Disclosure (AXFR)	medium
10549	ISC BIND < 8.2.2-P7 Compressed ZXFR Name Service Query DoS	high
10539	DNS Server Recursive Query Cache Poisoning Weakness	medium
10029	ISC BIND < 4.9.7-REL / 8.2.2-P5 Multiple Remote Vulnerabilities	critical
10028	DNS Server BIND version Directive Remote Version Detection	info
10312	WindowsNT DNS Server Character Saturation DoS	medium

Detections

Analytics

DNS Family for Nessus

info

critical

medium

high

medium

critical

info

medium