BIND 名称服务器已更新至 9.9.3P2，修复了一个安全问题，该问题是对私人类型“keydata”进行不正确的边界检查，可导致可远程触发的 REQUIRE 失败。（CVE-2013-4854、bnc#831899）

远程主机安装的 McAfee Web Gateway (MWG) 版本低于 7.3.2.2。因此，它受到因打包的 ISC BIND 服务器中的缺陷而导致的拒绝服务漏洞的影响。攻击者可通过发送特别构建的包含畸形 RDATA 部分的查询来利用此漏洞。

远程 OracleVM 系统缺少解决关键安全更新的必要补丁：有关详细信息，请参阅 Oracle VM 安全公告 OVMSA-2020-0021。

远程 OracleVM 系统缺少解决关键安全更新的必要补丁：

  - 修复 CVE-2017-3136（ISC 变更 4575）

  - 修复 CVE-2017-3137 （ISC 变更 4578）

  - 修复并测试 DNAME 之前的缓存 CNAME（ISC 变更 4558）

  - 修复 CVE-2016-9147（ISC 变更 4510）

  - 修复由 CVE-2016-8864 引入的回归（ISC 变更 4530）

  - 在 named 重新启动之前还原 SELinux 上下文

  - 仅在 chroot 中已存在目录时使用 /lib 或 /lib64

  - 加强 NSS 库模式，转义 chroot 挂载路径

  - 修复 (CVE-2016-8864)

  - 请勿更改 chroot 中的 lib 权限 (#1321239)

  - 支持 chroot 中的 WKS 记录 (#1297562)

  - 文档中不包含补丁备份（修复 #1325081 补丁）

  - 已向后移植 [RT #39567] 的相关部分 (#1259923)

  - 将 ISC_SOCKET_MAXEVENTS 增加至 2048 (#1326283)

  - 修复 nsupdate 脚本中上游等多个领域 (#1313286)

  - 修复 nsupdate 脚本中的多个领域 (#1313286)

  - 使用足够高的 resolver-query-timeout 恢复所有转发器 (#1325081)

  - 修复 (CVE-2016-2848)

  - 修复 start_lookup 中的无限循环 (#1306504)

  - 修复 (CVE-2016-2776)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-8500 (#1171973)

  - Use /dev/urandom when generating rndc.key file (#951255)

  - Remove bogus file from /usr/share/doc, introduced by fix     for bug #1092035

  - Add support for TLSA resource records (#956685)

  - Increase defaults for lwresd workers and make workers     and client objects number configurable (#1092035)

  - Fix segmentation fault in nsupdate when -r option is     used (#1064045)

  - Fix race condition on send buffer in host tool when     sending UDP query (#1008827)

  - Allow authentication using TSIG in allow-notify     configuration statement (#1044545)

  - Fix SELinux context of /var/named/chroot/etc/localtime     (#902431)

  - Include updated named.ca file with root server addresses     (#917356)

  - Don't generate rndc.key if there is rndc.conf on     start-up (#997743)

  - Fix dig man page regarding how to disable IDN (#1023045)

  - Handle ICMP Destination unreachable (Protocol     unreachable) response (#1066876)

  - Configure BIND with --with-dlopen=yes to support     dynamically loadable DLZ drivers (#846065)

  - Fix initscript to return correct exit value when calling     checkconfig/configtest/check/test (#848033)

  - Don't (un)mount chroot filesystem when running     initscript command configtest with running server     (#851123)

  - Fix zone2sqlite tool to accept zones containing '.' or     '-' or starting with a digit (#919414)

  - Fix initscript not to mount chroot filesystem is named     is already running (#948743)

  - Fix initscript to check if the PID in PID-file is really     s PID of running named server (#980632)

  - Correct the installed documentation ownership (#1051283)

  - configure with --enable-filter-aaaa to enable use of     filter-aaaa-on-v4 option (#1025008)

  - Fix race condition when destroying a resolver fetch     object (#993612)

  - Fix the RRL functionality to include     referrals-per-second and nodata-per-second options     (#1036700)

  - Fix segfault on SERVFAIL to NXDOMAIN failover (#919545)

  - Fix (CVE-2014-0591)

  - Fix gssapictx memory leak (#911167)

  - fix (CVE-2013-4854)

  - fix (CVE-2013-2266)

  - ship dns/rrl.h in -devel subpkg

  - remove one bogus file from /usr/share/doc, introduced by     RRL patch

  - fix (CVE-2012-5689)

  - add response rate limit patch (#873624)

Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in BIND. A remote attacker could use this flaw to send a specially crafted DNS query to named that, when processed, would cause named to crash when rejecting the malformed query. (CVE-2013-4854)

All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

Updated bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

A denial of service flaw was found in BIND. A remote attacker could use this flaw to send a specially crafted DNS query to named that, when processed, would cause named to crash when rejecting the malformed query. (CVE-2013-4854)

All bind97 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1115 advisory.

    [32:9.7.0-17.P2.2]
    - fix for CVE-2013-4854

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host has a version of McAfee Firewall Enterprise installed that is affected by a denial of service vulnerability due to a flaw in the packaged ISC BIND server. An attacker can exploit this by sending a specially crafted query with a malformed RDATA section.

The version of ISC BIND detected on this server is known to improperly handle malformed RDATA data within a DNS query. This can trigger a denial of service when processing such a packet.

ID	Name	Product	Family	Published	Updated	Severity
75123	openSUSE 安全更新：bind (openSUSE-SU-2013:1353-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
76120	McAfee Web Gateway < 7.3.2.2 DoS (SB10052)	Nessus	Misc.	6/18/2014	7/14/2018	high
137170	OracleVM 3.3 / 3.4：bind (OVMSA-2020-0021)	Nessus	OracleVM Local Security Checks	6/5/2020	3/7/2024	medium
99569	OracleVM 3.3 / 3.4：bind (OVMSA-2017-0066)	Nessus	OracleVM Local Security Checks	4/21/2017	1/4/2021	high
80247	OracleVM 3.3 : bind (OVMSA-2014-0084)	Nessus	OracleVM Local Security Checks	12/26/2014	1/4/2021	high
69110	RHEL 6 : bind (RHSA-2013:1114)	Nessus	Red Hat Local Security Checks	7/30/2013	1/14/2021	high
69111	RHEL 5 : bind97 (RHSA-2013:1115)	Nessus	Red Hat Local Security Checks	7/30/2013	1/14/2021	high
69157	Oracle Linux 5 : bind97 (ELSA-2013-1115)	Nessus	Oracle Linux Local Security Checks	7/31/2013	4/29/2025	high
76118	McAfee Firewall Enterprise DoS (SB10052)	Nessus	Firewalls	6/18/2014	11/15/2018	high
69140	CentOS 6 : bind (CESA-2013:1114)	Nessus	CentOS Local Security Checks	7/31/2013	1/4/2021	high
69141	CentOS 5 : bind97 (CESA-2013:1115)	Nessus	CentOS Local Security Checks	7/31/2013	1/4/2021	high
6964	ISC BIND 9 DNS RDATA Handling Remote DoS	Nessus Network Monitor	DNS Servers	8/8/2013	3/6/2019	high

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

high

high

high

high

high

high