A weakness was found in the DNS protocol by Dan Kaminsky. A remote attacker could exploit this weakness to spoof DNS entries and poison DNS caches. This could be used to misdirect users and services; i.e.
for web and email traffic (CVE-2008-1447).

This update provides the latest stable BIND releases for all platforms except Corporate Server/Desktop 3.0 and MNF2, which have been patched to correct the issue.

The transaction id and the udp source port used for DNS queries by the bind nameserver were predictable. Attackers could potentially exploit that weakness to manipulate the DNS cache ('DNS cache poisoning', CVE-2008-1447).

Additionally the root.hint zone file was updated to contain the new IP number of the 'L' root DNS server.

The DNS protocol protects against spoofing attacks by requiring an attacker to predict both the DNS transaction ID and UDP source port of a request. In recent years, a number of papers have found problems with DNS implementations which make it easier for an attacker to perform DNS cache-poisoning attacks.

Previous versions of BIND did not use randomized UDP source ports. If an attacker was able to predict the random DNS transaction ID, this could make DNS cache-poisoning attacks easier. In order to provide more resilience, BIND has been updated to use a range of random UDP source ports. (CVE-2008-1447)

Note: This errata also updates SELinux policy to allow BIND to use random UDP source ports.

The remote host is affected by the vulnerability described in GLSA-201209-25 (VMware Player, Server, Workstation: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VMware Player, Server,       and Workstation. Please review the CVE identifiers referenced below for       details.
  Impact :

    Local users may be able to gain escalated privileges, cause a Denial of       Service, or gain sensitive information.
    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in the remote execution of arbitrary code, or a Denial       of Service. Remote attackers also may be able to spoof DNS traffic, read       arbitrary files, or inject arbitrary web script to the VMware Server       Console.
    Furthermore, guest OS users may be able to execute arbitrary code on the       host OS, gain escalated privileges on the guest OS, or cause a Denial of       Service (crash the host OS).
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2017-3136 (ISC change 4575)

  - Fix CVE-2017-3137 (ISC change 4578)

  - Fix and test caching CNAME before DNAME (ISC change     4558)

  - Fix CVE-2016-9147 (ISC change 4510)

  - Fix regression introduced by CVE-2016-8864 (ISC change     4530)

  - Restore SELinux contexts before named restart

  - Use /lib or /lib64 only if directory in chroot already     exists

  - Tighten NSS library pattern, escape chroot mount path

  - Fix (CVE-2016-8864)

  - Do not change lib permissions in chroot (#1321239)

  - Support WKS records in chroot (#1297562)

  - Do not include patch backup in docs (fixes #1325081     patch)

  - Backported relevant parts of [RT #39567] (#1259923)

  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283)

  - Fix multiple realms in nsupdate script like upstream     (#1313286)

  - Fix multiple realm in nsupdate script (#1313286)

  - Use resolver-query-timeout high enough to recover all     forwarders (#1325081)

  - Fix (CVE-2016-2848)

  - Fix infinite loop in start_lookup (#1306504)

  - Fix (CVE-2016-2776)

The remote host is running a version of BIND DNS server which fails to randomize the UDP source port.  This could allow an attacker to poison the DNS cache.  A poisoned cache means that DNS clients can be directed to rogue sites and greatly simplifies phishing attacks.

The remote host is running a DNS server that is configured to use port 53 as its source port for queries.  This is extremely dangerous as an attacker only needs to spoof a 16-bit transaction ID in order to poison the DNS cache.  A poisoned cache means that DNS clients can be directed to rogue sites and greatly simplifies phishing attacks.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.5.  Mac OS X 10.5.5 contains security fixes for a number of programs.

ID	Name	Product	Family	Published	Updated	Severity
36526	Mandriva Linux Security Advisory : bind (MDVSA-2008:139)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	medium
41221	SuSE9 Security Update : bind (YOU Patch Number 12197)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	medium
60437	Scientific Linux Security Update : bind on SL 3.0.x , SL 4.x, SL 5.x	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
62383	GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/1/2012	1/6/2021	medium
99569	OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	4/21/2017	1/4/2021	high
4578	ISC BIND DNS Query ID Field Prediction Cache Poisoning (deprecated)	Nessus Network Monitor	DNS Servers	8/18/2004	3/6/2019	medium
4601	DNS Server Source Port 53 Query Usage	Nessus Network Monitor	DNS Servers	7/22/2008	3/6/2019	medium
4682	Mac OS X < 10.5.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	9/16/2008	3/6/2019	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

medium

critical