Security Fix(es) :

  - bind: BIND does not sufficiently limit the number of     fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity     can be used to trigger an assertion failure in tsig.c     (CVE-2020-8617)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2344 advisory.

  - bind: BIND does not sufficiently limit the number of fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in     tsig.c (CVE-2020-8617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2383 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2383 advisory.

  - bind: BIND does not sufficiently limit the number of     fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity     can be used to trigger an assertion failure in tsig.c     (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2338 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2338 advisory.

  - bind: BIND does not sufficiently limit the number of     fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity     can be used to trigger an assertion failure in tsig.c     (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.01, has bind packages installed that are affected by multiple vulnerabilities:

  - With pipelining enabled each incoming query on a TCP     connection requires a similar resource allocation to a     query received via UDP or via TCP without pipelining     enabled. A client using a TCP-pipelined connection to a     server could consume more resources than the server has     been provisioned to handle. When a TCP connection with a     large number of pipelined queries is closed, the load on     the server releasing these multiple resources can cause     it to become unresponsive, even for queries that can be     answered authoritatively or from cache. (This is most     likely to be perceived as an intermittent server     problem). (CVE-2019-6477)

  - A malicious actor who intentionally exploits this lack     of effective limitation on the number of fetches     performed when processing referrals can, through the use     of specially crafted referrals, cause a recursing server     to issue a very large number of fetches in an attempt to     process the referral. This has at least two potential     effects: The performance of the recursing server can     potentially be degraded by the additional work required     to perform these fetches, and The attacker can exploit     this behavior to use the recursing server as a reflector     in a reflection attack with a high amplification factor.
    (CVE-2020-8616)

  - Using a specially-crafted message, an attacker may     potentially cause a BIND server to reach an inconsistent     state if the attacker knows (or successfully guesses)     the name of a TSIG key used by the server. Since BIND,     by default, configures a local session key even on     servers whose configuration does not otherwise make use     of it, almost all current BIND servers are vulnerable.
    In releases of BIND dating from March 2018 and after, an     assertion check in tsig.c detects this inconsistent     state and deliberately exits. Prior to the introduction     of the check the server would continue operating in an     inconsistent state, with potentially harmful results.
    (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A malicious actor who intentionally exploits this lack     of effective limitation on the number of fetches     performed when processing referrals can, through the     use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an     attempt to process the referral. This has at least two     potential effects: The performance of the recursing     server can potentially be degraded by the additional     work required to perform these fetches, and The     attacker can exploit this behavior to use the recursing     server as a reflector in a reflection attack with a     high amplification factor.(CVE-2020-8616)

  - Using a specially-crafted message, an attacker may     potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or     successfully guesses) the name of a TSIG key used by     the server. Since BIND, by default, configures a local     session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND     servers are vulnerable. In releases of BIND dating from     March 2018 and after, an assertion check in tsig.c     detects this inconsistent state and deliberately exits.
    Prior to the introduction of the check the server would     continue operating in an inconsistent state, with     potentially harmful results.(CVE-2020-8617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3475 advisory.

  - bind: BIND does not sufficiently limit the number of fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in     tsig.c (CVE-2020-8617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Using a specially-crafted message, an attacker may     potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or     successfully guesses) the name of a TSIG key used by     the server. Since BIND, by default, configures a local     session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND     servers are vulnerable. In releases of BIND dating from     March 2018 and after, an assertion check in tsig.c     detects this inconsistent state and deliberately exits.
    Prior to the introduction of the check the server would     continue operating in an inconsistent state, with     potentially harmful results.(CVE-2020-8617)

  - A malicious actor who intentionally exploits this lack     of effective limitation on the number of fetches     performed when processing referrals can, through the     use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an     attempt to process the referral. This has at least two     potential effects: The performance of the recursing     server can potentially be degraded by the additional     work required to perform these fetches, and The     attacker can exploit this behavior to use the recursing     server as a reflector in a reflection attack with a     high amplification factor.(CVE-2020-8616)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Using a specially-crafted message, an attacker may     potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or     successfully guesses) the name of a TSIG key used by     the server. Since BIND, by default, configures a local     session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND     servers are vulnerable. In releases of BIND dating from     March 2018 and after, an assertion check in tsig.c     detects this inconsistent state and deliberately exits.
    Prior to the introduction of the check the server would     continue operating in an inconsistent state, with     potentially harmful results.(CVE-2020-8617)

  - A malicious actor who intentionally exploits this lack     of effective limitation on the number of fetches     performed when processing referrals can, through the     use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an     attempt to process the referral. This has at least two     potential effects: The performance of the recursing     server can potentially be degraded by the additional     work required to perform these fetches, and The     attacker can exploit this behavior to use the recursing     server as a reflector in a reflection attack with a     high amplification factor.(CVE-2020-8616)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Using a specially-crafted message, an attacker may     potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or     successfully guesses) the name of a TSIG key used by     the server. Since BIND, by default, configures a local     session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND     servers are vulnerable. In releases of BIND dating from     March 2018 and after, an assertion check in tsig.c     detects this inconsistent state and deliberately exits.
    Prior to the introduction of the check the server would     continue operating in an inconsistent state, with     potentially harmful results.(CVE-2020-8617)

  - A malicious actor who intentionally exploits this lack     of effective limitation on the number of fetches     performed when processing referrals can, through the     use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an     attempt to process the referral. This has at least two     potential effects: The performance of the recursing     server can potentially be degraded by the additional     work required to perform these fetches, and The     attacker can exploit this behavior to use the recursing     server as a reflector in a reflection attack with a     high amplification factor.(CVE-2020-8616)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has bind packages installed that are affected by multiple vulnerabilities:

  - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches     performed when processing referrals can, through the use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an attempt to process the referral. This has at least     two potential effects: The performance of the recursing server can potentially be degraded by the     additional work required to perform these fetches, and The attacker can exploit this behavior to use the     recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

  - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the     server. Since BIND, by default, configures a local session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating     from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately     exits. Prior to the introduction of the check the server would continue operating in an inconsistent     state, with potentially harmful results. (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137041	Scientific Linux Security Update : bind on SL7.x x86_64 (20200601)	Nessus	Scientific Linux Local Security Checks	6/2/2020	3/8/2024	high
137082	RHEL 7 : bind (RHSA-2020:2344)	Nessus	Red Hat Local Security Checks	6/3/2020	3/8/2024	high
137129	Oracle Linux 6 : bind (ELSA-2020-2383)	Nessus	Oracle Linux Local Security Checks	6/4/2020	3/7/2024	high
137219	Oracle Linux 8 : bind (ELSA-2020-2338)	Nessus	Oracle Linux Local Security Checks	6/8/2020	3/7/2024	high
138773	NewStart CGSL MAIN 6.01 : bind Multiple Vulnerabilities (NS-SA-2020-0031)	Nessus	NewStart CGSL Local Security Checks	7/21/2020	2/29/2024	high
139125	EulerOS 2.0 SP8 : bind (EulerOS-SA-2020-1795)	Nessus	Huawei Local Security Checks	7/30/2020	2/27/2024	high
139669	RHEL 7 : bind (RHSA-2020:3475)	Nessus	Red Hat Local Security Checks	8/18/2020	2/26/2024	high
140000	EulerOS Virtualization for ARM 64 3.0.6.0 : bind (EulerOS-SA-2020-1897)	Nessus	Huawei Local Security Checks	8/28/2020	2/22/2024	high
140137	EulerOS 2.0 SP5 : bind (EulerOS-SA-2020-1916)	Nessus	Huawei Local Security Checks	9/2/2020	2/22/2024	high
142543	EulerOS Virtualization 3.0.6.6 : bind (EulerOS-SA-2020-2444)	Nessus	Huawei Local Security Checks	11/6/2020	2/9/2024	high
154482	NewStart CGSL CORE 5.05 / MAIN 5.05 : bind Multiple Vulnerabilities (NS-SA-2021-0137)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	11/27/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high