The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1202 advisory.

    [32:9.8.2-0.62.rc1.2]
    - Fix DNSKEY that encountered a CNAME (#1447869, ISC change 3391)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A denial of service flaw was found in the way BIND     handled DNSSEC validation. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS response.
    (CVE-2017-3139)

Note: This issue affected only the BIND versions as shipped with EL6.

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3139)

Note: This issue affected only the BIND versions as shipped with Red Hat Enterprise Linux 6. This issue did not affect any upstream versions of BIND.

A denial of service flaw was found in the way BIND handled DNSSEC validation.

A remote attacker could use this flaw to make named exit unexpectedly with an

assertion failure via a specially crafted DNS response.
(CVE-2017-3139)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use     this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.
    (CVE-2017-3139)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1649:04 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS     (Domain Name System) protocols. BIND includes a DNS server (named),     which resolves host names to IP addresses; a resolver library     (routines for applications to use when interfacing with DNS); and     tools for verifying that the DNS server is operating properly.
    Security issues fixed with this release:
    CVE-2017-3139
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has bind packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way BIND handled TSIG     authentication for dynamic updates. A remote attacker     able to communicate with an authoritative BIND server     could use this flaw to manipulate the contents of a     zone, by forging a valid TSIG or SIG(0) signature for a     dynamic update request. (CVE-2017-3143)

  - A flaw was found in the way BIND handled TSIG     authentication of AXFR requests. A remote attacker, able     to communicate with an authoritative BIND server, could     use this flaw to view the entire contents of a zone by     sending a specially constructed request packet.
    (CVE-2017-3142)

  - A denial of service flaw was found in the way BIND     handled DNSSEC validation. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS response.
    (CVE-2017-3139)

  - A denial of service flaw was found in the way BIND     handled a query response containing CNAME or DNAME     resource records in an unusual order. A remote attacker     could use this flaw to make named exit unexpectedly with     an assertion failure via a specially crafted DNS     response. (CVE-2017-3137)

  - It was found that the lightweight resolver protocol     implementation in BIND could enter an infinite recursion     and crash when asked to resolve a query name which, when     combined with a search list entry, exceeds the maximum     allowable length. A remote attacker could use this flaw     to crash lwresd or named when using the lwres     statement in named.conf. (CVE-2016-2775)

  - A denial of service flaw was found in the way BIND     handled query requests when using DNS64 with break-     dnssec yes option. A remote attacker could use this     flaw to make named exit unexpectedly with an assertion     failure via a specially crafted DNS request.
    (CVE-2017-3136)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3139)

Note: This issue affected only the BIND versions as shipped with Red Hat Enterprise Linux 6. This issue did not affect any upstream versions of BIND.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1582 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME     resource records in an unusual order. A remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3137)

    * A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could     use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS     response. (CVE-2017-3139)

    Red Hat would like to thank ISC for reporting CVE-2017-3137.

    Bug Fix(es):

    * ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017.
    Maintaining an up-to-date KSK, by adding the new root zone KSK, is essential for ensuring that validating     DNS resolvers continue to function following the rollover. (BZ#1458229, BZ#1458230, BZ#1458231,     BZ#1458232, BZ#1458233)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
100046	Oracle Linux 6 : bind (ELSA-2017-1202)	Nessus	Oracle Linux Local Security Checks	5/9/2017	10/23/2024	high
100048	Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20170508)	Nessus	Scientific Linux Local Security Checks	5/9/2017	12/19/2025	high
100047	RHEL 6 : bind (RHSA-2017:1202)	Nessus	Red Hat Local Security Checks	5/9/2017	12/19/2025	high
100066	CentOS 6 : bind (CESA-2017:1202)	Nessus	CentOS Local Security Checks	5/10/2017	1/4/2021	high
100553	Amazon Linux AMI : bind (ALAS-2017-833)	Nessus	Amazon Linux Local Security Checks	6/1/2017	12/17/2025	high
221090	Linux Distros Unpatched Vulnerability : CVE-2017-3139	Nessus	Misc.	3/4/2025	1/28/2026	high
289282	MiracleLinux 4 : bind-9.8.2-0.62.2.0.1.rc1.AXS4 (AXSA:2017-1649:04)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
127330	NewStart CGSL MAIN 4.05 : bind Multiple Vulnerabilities (NS-SA-2019-0102)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	2/24/2025	medium
101461	Virtuozzo 6 : bind / bind-chroot / bind-devel / bind-libs / etc (VZLSA-2017-1202)	Nessus	Virtuozzo Local Security Checks	7/13/2017	12/11/2025	high
101099	RHEL 6 : bind (RHSA-2017:1582)	Nessus	Red Hat Local Security Checks	6/29/2017	11/4/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

medium

high

high