resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.

The remote NewStart CGSL host, running version MAIN 6.02, has bind packages installed that are affected by multiple vulnerabilities:

  - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when     answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for     remote attackers to guess the next query id and perform DNS cache poisoning. (CVE-2007-2926)

  - Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions,     which allows local users to perform unauthorized named commands, such as causing a denial of service by     stopping named. (CVE-2007-6283)

  - Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in     FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
    (CVE-2008-0122)

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

  - BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL     DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a     malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. (CVE-2009-0025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of ISC BIND 9.10.x prior to 9.10.3-P4 are unpatched for a flaw in 'resolver.c' that is triggered when handling a packet with multiple DNS cookies.  This may allow a remote attacker to cause a denial of service.

The remote host is affected by the vulnerability described in GLSA-201610-07 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition through       multiple attack vectors.
  Workaround :

    There is no known workaround at this time.

New version fixing CVE-2016-1285 CVE-2016-1286 CVE-2016-2088

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC reports :

A response containing multiple DNS cookies causes servers with cookie support enabled to exit with an assertion failure.

According to its self-reported version number, ISC BIND installed on the remote name server is affected by a denial of service vulnerability in file resolver.c when DNS cookies are enabled. An unauthenticated, remote attacker can exploit his, via a malformed packet with more than one cookie option, to cause an INSIST assertion failure and daemon exit.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in files     resolver.c and db.c when handling DNAME resource     signatures. An unauthenticated, remote attacker can     exploit this, via a crafted query that generates a     response containing a signature record, to cause an     assertion failure and daemon exit. (CVE-2016-1286)

  - A denial of service vulnerability exists in resolver.c     when DNS cookies are enabled. An unauthenticated, remote     attacker can exploit this, via a malformed cookie with     more than one cookie option, to cause an INSIST     assertion failure and daemon exit. (CVE-2016-2088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in files     sexpr.c and alist.c when handling control channel     packets. An unauthenticated, remote attacker can     exploit this, via crafted packets sent to the control     channel (rndc) interface, to cause an assertion failure     and daemon exit. (CVE-2016-1285)

  - A denial of service vulnerability exists in resolver.c     when DNS cookies are enabled. An unauthenticated, remote     attacker can exploit this, via a malformed cookie with     more than one cookie option, to cause an INSIST     assertion failure and daemon exit. (CVE-2016-2088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206846	NewStart CGSL MAIN 6.02 : bind Multiple Vulnerabilities (NS-SA-2024-0060)	Nessus	NewStart CGSL Local Security Checks	high
9873	ISC BIND 9.10.x < 9.10.3-P4 DoS	Nessus Network Monitor	DNS Servers	high
93994	GLSA-201610-07 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
90329	Fedora 22 : bind-9.10.3-9.P4.fc22 (2016-364c0a9df4)	Nessus	Fedora Local Security Checks	high
90239	FreeBSD : bind -- denial of service vulnerability (cd409df7-f483-11e5-92ce-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
90215	Fedora 24 : bind-9.10.3-12.P4.fc24 (2016-75f31fbb0a)	Nessus	Fedora Local Security Checks	high
90000	ISC BIND 9 resolver.c Multiple DNS Cookie Packet Handling DoS	Nessus	DNS	medium
89999	ISC BIND 9 Multiple DoS	Nessus	DNS	high
89998	ISC BIND 9 Multiple DoS	Nessus	DNS	medium
89885	Fedora 23 : bind-9.10.3-12.P4.fc23 (2016-b593e84223)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-2088

medium

Tenable Plugins

high

high

high

high

medium

high

medium

high

medium

high