Detections
Analytics
ISC BIND 9 DNSSEC NSEC/NSEC3 Bogus NXDOMAIN Responses
medium Nessus Plugin ID 44116
Language:
Synopsis
The remote name server is affected by a cache poisoning vulnerability.Description
According to its version number, the remote installation of BIND suffers from a cache poisoning vulnerability. The vulnerability exists due to an error in DNSSEC NSEC/NSEC3 validation code which could cause caching of bogus NXDOMAIN responses without correctly validating them. This issue affects all versions prior to 9.4.3-P5, 9.5.2-P2, 9.6.1-P3 or pre-releases of 9.7.0.Note that only nameservers that allow recursive queries and validate DNSSEC records are affected. Nessus has tried to verify if the remote service supports DNSSEC options, but has not verified if the remote service allows recursive queries, so this could be a false positive.
Solution
Upgrade to BIND 9.4.3-P5, 9.5.2-P2 or 9.6.1-P3 or later.Note that fixes for 9.7.0 pre-releases are not available as of 2010/01/22.
Plugin Details
Severity: Medium
ID: 44116
File Name: bind9_bogus_nxdomain_caching.nasl
Version: 1.11
Type: remote
Family: DNS
Published: 1/22/2010
Updated: 6/27/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:isc:bind
Required KB Items: bind/version, Settings/ParanoidReport
Exploit Ease: No known exploits are available
Patch Publication Date: 1/19/2010
Vulnerability Publication Date: 1/19/2010
Reference Information
CVE: CVE-2010-0097
BID: 37865