The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has bind packages installed that are affected by multiple vulnerabilities:

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons     could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be     usable for denial-of-service attacks). (CVE-2018-20843)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 ->     9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND     9 Supported Preview Edition, An attacker on the network     path for a TSIG-signed request, or operating the server     receiving the TSIG-signed request, could send a     truncated response to that request, triggering an     assertion failure, causing the server to exit.
    Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent,     along with other characteristics of the packet and     message, and spoof a truncated response to trigger an     assertion failure, causing the server to     exit.(CVE-2020-8622)

  - A malicious actor who intentionally exploits this lack     of effective limitation on the number of fetches     performed when processing referrals can, through the     use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an     attempt to process the referral. This has at least two     potential effects: The performance of the recursing     server can potentially be degraded by the additional     work required to perform these fetches, and The     attacker can exploit this behavior to use the recursing     server as a reflector in a reflection attack with a     high amplification factor.(CVE-2020-8616)

  - Using a specially-crafted message, an attacker may     potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or     successfully guesses) the name of a TSIG key used by     the server. Since BIND, by default, configures a local     session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND     servers are vulnerable. In releases of BIND dating from     March 2018 and after, an assertion check in tsig.c     detects this inconsistent state and deliberately exits.
    Prior to the introduction of the check the server would     continue operating in an inconsistent state, with     potentially harmful results.(CVE-2020-8617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.06, has bind packages installed that are affected by multiple vulnerabilities:

  - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the     server. Since BIND, by default, configures a local session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating     from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately     exits. Prior to the introduction of the check the server would continue operating in an inconsistent     state, with potentially harmful results. (CVE-2020-8617)

  - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches     performed when processing referrals can, through the use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an attempt to process the referral. This has at least     two potential effects: The performance of the recursing server can potentially be degraded by the     additional work required to perform these fetches, and The attacker can exploit this behavior to use the     recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
154490	NewStart CGSL CORE 5.05 / MAIN 5.05 : bind Multiple Vulnerabilities (NS-SA-2021-0153)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	10/27/2021	medium
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	9/1/2022	2/17/2025	medium
140830	EulerOS 2.0 SP3 : bind (EulerOS-SA-2020-2063)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
147339	NewStart CGSL MAIN 4.06 : bind Multiple Vulnerabilities (NS-SA-2021-0003)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	1/11/2024	high

Detections

Analytics

Plugins Search

medium

medium

high

high