The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7241-1 advisory.

    Toshifumi Sakaguchi discovered that Bind incorrectly handled many records in the additional section. A     remote attacker could possibly use this issue to cause Bind to consume CPU resources, leading to a denial     of service. (CVE-2024-11187)

    Jean-Franois Billaud discovered that the Bind DNS-over-HTTPS implementation incorrectly handled a heavy     query load. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to     a denial of service. (CVE-2024-12705)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0427-1 advisory.

    - CVE-2024-11187: Fixes CPU exhaustion caused by many records in the additional section (bsc#1236596)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1676 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1691 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1685 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-1675 advisory.

    - Limit additional section records CPU processing (CVE-2024-11187)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:1676 advisory.

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-1718 advisory.

    [32:9.11.4-26.0.3.P2.16]
    - Resolve CVE-2024-11187 [Orabug: 37616907]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5854 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5854-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     January 29, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2024-11187 CVE-2024-12705

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in denial of service.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:9.18.33-1~deb12u2.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4050 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4050-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Paride Legovini     February 11, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : bind9     Version        : 1:9.16.50-1~deb11u3     CVE ID         : CVE-2024-11187

    One vulnerability was discovered in BIND, a DNS server implementation, which     may result in denial of service.

    It is possible to construct a zone such that some queries to it will generate     responses containing numerous records in the Additional section. An attacker     sending many such queries can cause either the authoritative server itself or     an independent resolver to use disproportionate resources processing the     queries. Zones will usually need to have been deliberately crafted to exploit     this flaw.

    For Debian 11 bullseye, this problem has been fixed in version     1:9.16.50-1~deb11u3.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    It is possible to construct a zone such that some queries to it will generate responses containing     numerous records in the Additional section. An attacker sending many such queries can cause either the     authoritative server itself or an independent resolver to use disproportionate resources processing the     queries. Zones will usually need to have been deliberately crafted to attack this     exposure.(CVE-2024-11187)

Tenable has extracted the preceding description block directly from the EulerOS dhcp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01787-1 advisory.

    Update to version 9.20.9.

    - Security issues fixed:

      * CVE-2025-40775: denial-of-service due to assertion failure caused by the processing of a NS message     with an invalid         TSIG (bsc#1243361).
      * CVE-2024-12705: CPU and memory exhaustion due to DNS-over-HTTPS issues that arise under heavy query     load         (bsc#1236597).
      * CVE-2024-11187: CPU exhaustion when processing queries that lead to responses containing several     records in the         Additional data section (bsc#1236596).

    - Changelog:

      - Feature changes:
        * Performance optimization for NSEC3 lookups introduced in BIND 9.20.2           was reverted to avoid risks associated with a complex code change.
        * The configuration clauses parental-agents and primaries are renamed           to remote-servers.
        * Add none parameter to query-source and query-source-v6 to disable           IPv4 or IPv6 upstream queries but allow listening to queries from           clients on IPv4 or IPv6.
        * dnssec-ksr now supports KSK rollovers.
        * Print RFC 7314: EXPIRE option in transfer summary.
        * Emit more helpful log messages for exceeding max-records-per-type.
        * Harden key management when key files have become unavailable.

      - New Features:
        * Add support for EDE 20 (Not Authoritative).
        * Add support for EDE 7 and EDE 8.
        * `dig` can now display the received BADVERS message during           negotiation.
        * Add an `rndc` command to reset some statistics counters.
        * Implement the min-transfer-rate-in configuration option.
        * Add HTTPS record query to host command line tool.
        * Implement sig0key-checks-limit and sig0message-checks-limit.
        * Adds support for EDE code 1 and 2.
        * Add an rndc command to toggle jemalloc profiling.
        * Add support for multiple extended DNS errors.
        * Print the expiration time of stale records.
        * Add Extended DNS Error Code 22 - No Reachable Authority.
        * Add a new option to configure the maximum number of outgoing queries           per client request.
        * Use the Server Name Indication (SNI) extension for all outgoing TLS           connections.
        * Update built-in bind.keys file with the new 2025 IANA root key.
        * Add an initial-ds entry to bind.keys for the new root key, ID           38696, which is scheduled for publication in January 2025.

      - Bug Fixes:
        * Restore NSEC3 closest-encloser lookup improvements.
        * Stop caching lack of EDNS support.
        * Fix resolver statistics counters for timed-out responses.
        * Nested DNS validation could cause an assertion failure.
        * Wait for memory reclamation to finish in `named-checkconf`.
        * Ensure `max-clients-per-query` is at least `clients-per-query`.
        * Fix write after free in validator code.
        * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
        * Fix several small DNSSEC timing issues.
        * Fix inconsistency in CNAME/DNAME handling during resolution.
        * Fix dual-stack-servers configuration option.
        * Fix a data race causing a permanent active client increase.
        * Fix deferred validation of unsigned DS and DNSKEY records.
        * Fix RPZ race condition during a reconfiguration.
        * 'CNAME and other data check' not applied to all types.
        * Relax private DNSKEY and RRSIG constraints.
        * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
        * Fix TTL issue with ANY queries processed through RPZ 'passthru';.
        * dnssec-signzone needs to check for a NULL key when setting offline.
        * Fix a bug in the statistics channel when querying zone transfer           information.
        * Fix assertion failure when dumping recursing clients.
        * Dump the active resolver fetches from dns_resolver_dumpfetches().
        * Recently expired records could be returned with a timestamp in           future.
        * YAML string not terminated in negative response in delv.
        * Fix a bug in dnssec-signzone related to keys being offline.
        * Apply the memory limit only to ADB database items.
        * Avoid unnecessary locking in the zone/cache database.
        * Fix reporting of Extended DNS Error 22 (No Reachable Authority).
        * Fix nsupdate hang when processing a large update.
        * Fix possible assertion failure when reloading server while           processing update policy rules.
        * Preserve cache across reconfig when using attach-cache.
        * Resolve the spurious drops in performance due to glue cache.
        * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
        * Fix improper handling of unknown directives in resolv.conf.
        * Fix response policy zones and catalog zones with an $INCLUDE           statement defined.
        * Use TLS for notifies if configured to do so.
        * Notifies configured to use TLS will now be sent over TLS, instead of           plain text UDP or TCP. Also, failing to load the TLS           configuration for notify now results in an error.'
        * {&dns} is as valid as {?dns} in a SVCB's dohpath.
        * dig failed to parse a valid SVCB record with a dohpath URI template           containing a {&dns}, like           'dohpath=/some/path?key=value{&dns}';.
        * Fix NSEC3 closest encloser lookup for names with empty non-terminals.
        * A previous performance optimization for finding the NSEC3 closest           encloser when generating authoritative responses could cause servers           to return incorrect NSEC3 records in some cases. This has been fixed.
        * recursive-clients statement with value 0 triggered an assertion           failure.
        * BIND 9.20.0 broke recursive-clients 0;. This has now been fixed.
        * Parsing of hostnames in rndc.conf was broken.
        * When DSCP support was removed, parsing of hostnames in rndc.conf was           accidentally broken, resulting in an assertion failure. This has been           fixed.
        * `dig` options of the form [+-]option=<value> failed to display           the value on the printed command line. This has been fixed.
        * Provide more visibility into TLS configuration errors by logging           SSL_CTX_use_certificate_chain_file() and           SSL_CTX_use_PrivateKey_file() errors individually.
        * Fix a race condition when canceling ADB find which could cause an           assertion failure.
        * SERVFAIL cache memory cleaning is now more aggressive; it no longer           consumes a lot of memory if the server encounters many SERVFAILs at           once.
        * Fix trying the next primary XoT server when the previous one was           marked as unreachable.
        * In some cases named failed to try the next primary server in the           primaries list when the previous one was marked as unreachable. This           has been fixed.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
214790	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Bind vulnerabilities (USN-7241-1)	Nessus	Ubuntu Local Security Checks	1/29/2025	5/22/2025	high
216200	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2025:0427-1)	Nessus	SuSE Local Security Checks	2/12/2025	5/22/2025	high
216486	RHEL 8 : bind9.16 (RHSA-2025:1676)	Nessus	Red Hat Local Security Checks	2/19/2025	6/5/2025	high
216503	RHEL 8 : bind (RHSA-2025:1691)	Nessus	Red Hat Local Security Checks	2/19/2025	6/5/2025	high
216505	RHEL 6 : bind (RHSA-2025:1685)	Nessus	Red Hat Local Security Checks	2/19/2025	6/5/2025	high
216599	Oracle Linux 8 : bind (ELSA-2025-1675)	Nessus	Oracle Linux Local Security Checks	2/21/2025	5/22/2025	high
216865	RockyLinux 8 : bind9.16 (RLSA-2025:1676)	Nessus	Rocky Linux Local Security Checks	2/26/2025	2/26/2025	high
232600	Oracle Linux 7 : bind (ELSA-2025-1718)	Nessus	Oracle Linux Local Security Checks	3/11/2025	5/22/2025	high
214787	Debian dsa-5854 : bind9 - security update	Nessus	Debian Local Security Checks	1/29/2025	5/22/2025	high
216096	Debian dla-4050 : bind9 - security update	Nessus	Debian Local Security Checks	2/11/2025	5/22/2025	high
235140	Photon OS 5.0: Bindutils PHSA-2025-5.0-0511	Nessus	PhotonOS Local Security Checks	5/5/2025	5/5/2025	high
238175	EulerOS 2.0 SP13 : dhcp (EulerOS-SA-2025-1610)	Nessus	Huawei Local Security Checks	6/11/2025	6/11/2025	high
237601	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2025:01787-1)	Nessus	SuSE Local Security Checks	5/31/2025	5/31/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high