The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201502-03 (BIND: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause a denial of service condition by the lack of       GeoIP databases, or via a large or infinite number of referrals.
  Workaround :

    There is no known workaround at this time.

Versions of ISC BIND earlier than 9.10.1-P1 are unpatched for the following vulnerabilities:

  - Denial of service vulnerability that can be triggered when handling a maliciously constructed query or zone request, causing the service to issue unlimited queries in an attempt to follow a delegation (CVE-2014-8500)

  - Denial of service vulnerability in the pre-fetch feature that is triggered when the response to a specially crafted DNS query contains particular attributes. (CVE-2014-3214)

  - Denial of service vulnerability in EDNS option processing  (CVE-2014-3859)

  - Denial of service in three unspecified flaws in the GeoIP feature (CVE-2014-8680)

The version of ISC BIND detected on this server is affected by a programming error in the prefetch feature, which can be leveraged by an attacker to crash the affected application with a 'REQUIRE' assertion failure in the 'name.c' file. This issue namely affects recursive nameservers, of which NNM detected relevant traffic from this server.

According to its self-reported version number, the remote installation of BIND is affected by a denial of service vulnerability. The issue exists due to an error in the 'prefetch' feature which can cause named to terminate with a 'REQUIRE' assertion failure if it processes queries whose answers have particular attributes.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
82914	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-111-01)	Nessus	Slackware Local Security Checks	high
81226	GLSA-201502-03 : BIND: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
8569	ISC BIND 9.10.x < 9.10.1-P1 Multiple DoS	Nessus Network Monitor	DNS Servers	high
8247	ISC BIND 9.10.0 Recursive Nameserver DoS	Nessus Network Monitor	DNS Servers	medium
73945	ISC BIND 9 Recursive Server prefetch DoS	Nessus	DNS	medium

Detections

Analytics

CVE-2014-3214

high

Tenable Plugins

high

high

high

medium

medium