named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     constructed a response to a query that met certain     criteria. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure via a     specially crafted DNS request packet.(CVE-2016-2776)

  - A denial of service flaw was found in the way BIND     processed certain control channel input. A remote     attacker able to send a malformed packet to the control     channel could use this flaw to cause named to     crash.(CVE-2016-1285)

  - A flaw was found in the way BIND performed DNSSEC     validation. An attacker able to make BIND (functioning     as a DNS resolver with DNSSEC validation enabled)     resolve a name in an attacker-controlled domain could     cause named to exit unexpectedly with an assertion     failure.(CVE-2015-4620)

  - A flaw was found in the way BIND handled requests for     TKEY DNS resource records. A remote attacker could use     this flaw to make named (functioning as an     authoritative DNS server or a DNS resolver) exit     unexpectedly with an assertion failure via a specially     crafted DNS request packet.(CVE-2015-5477)

  - A denial of service flaw was found in the way BIND     handled queries for NSEC3-signed zones. A remote     attacker could use this flaw against an authoritative     name server that served NCES3-signed zones by sending a     specially crafted query, which, when processed, would     cause named to crash.(CVE-2014-0591)

  - A denial of service flaw was found in the way BIND     parsed certain malformed DNSSEC keys. A remote attacker     could use this flaw to send a specially crafted DNS     query (for example, a query requiring a response from a     zone containing a deliberately malformed key) that     would cause named functioning as a validating resolver     to crash.(CVE-2015-5722)

  - It was found that the lightweight resolver protocol     implementation in BIND could enter an infinite     recursion and crash when asked to resolve a query name     which, when combined with a search list entry, exceeds     the maximum allowable length. A remote attacker could     use this flaw to crash lwresd or named when using the     'lwres' statement in named.conf.(CVE-2016-2775)

  - A denial of service flaw was found in the way BIND     processed certain records with malformed class     attributes. A remote attacker could use this flaw to     send a query to request a cached record with a     malformed class attribute that would cause named     functioning as an authoritative or recursive server to     crash. Note: This issue affects authoritative servers     as well as recursive servers, however authoritative     servers are at limited risk if they perform     authentication when making recursive queries to resolve     addresses for servers listed in NS     RRSETs.(CVE-2015-8000)

  - A denial of service flaw was found in the way BIND     handled responses containing a DNAME answer. A remote     attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response.(CVE-2016-8864)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response.(CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     followed DNS delegations. A remote attacker could use a     specially crafted zone containing a large number of     referrals which, when looked up and processed, would     cause named to use excessive amounts of memory or     crash.(CVE-2014-8500)

  - A flaw was found in the way BIND handled trust anchor     management. A remote attacker could use this flaw to     cause the BIND daemon (named) to crash under certain     conditions.(CVE-2015-1349)

  - A denial of service flaw was found in the way BIND     parsed signature records for DNAME records. By sending     a specially crafted query, a remote attacker could use     this flaw to cause named to crash.(CVE-2016-1286)

  - A use-after-free flaw leading to denial of service was     found in the way BIND internally handled cleanup     operations on upstream recursion fetch contexts. A     remote attacker could potentially use this flaw to make     named, acting as a DNSSEC validating resolver, exit     unexpectedly with an assertion failure via a specially     crafted DNS request.(CVE-2017-3145)

  - A denial of service flaw was found in the way BIND     handled query requests when using DNS64 with     'break-dnssec yes' option. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS     request.(CVE-2017-3136)

  - A flaw was found in the way BIND handled TSIG     authentication of AXFR requests. A remote attacker,     able to communicate with an authoritative BIND server,     could use this flaw to view the entire contents of a     zone by sending a specially constructed request     packet.(CVE-2017-3142)

  - A flaw was found in the way BIND handled TSIG     authentication for dynamic updates. A remote attacker     able to communicate with an authoritative BIND server     could use this flaw to manipulate the contents of a     zone, by forging a valid TSIG or SIG(0) signature for a     dynamic update request.(CVE-2017-3143)

  - A denial of service flaw was discovered in bind     versions that include the 'deny-answer-aliases'     feature. This flaw may allow a remote attacker to     trigger an INSIST assert in named leading to     termination of the process and a denial of service     condition.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201708-01 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted DNS request to the BIND       resolver resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of bind installed on the remote AIX host is affected by a denial of service vulnerability due to a flaw that is triggered during the handling of a specially crafted answer packet in a response to an RTYPE ANY query. An unauthenticated, remote attacker can exploit this to cause an assertion failure and daemon exit.

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

Red Hat would like to thank ISC for reporting these issues.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for bind is now available for Red Hat Enterprise Linux 7.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-8864)

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

* A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3137)

Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Tony Finch (University of Cambridge) and Marco Davids (SIDN Labs) as the original reporters of CVE-2016-8864.

Bug Fix(es) :

* ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017. Maintaining an up-to-date KSK is essential for ensuring that validating DNS resolvers continue to function following the rollover. (BZ#1459648)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     handled query responses when both DNS64 and RPZ were     used. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure or a     null pointer dereference via a specially crafted DNS     response. (CVE-2017-3135)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response. (CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     handled a query response containing inconsistent DNSSEC     information. A remote attacker could use this flaw to     make named exit unexpectedly with an assertion failure     via a specially crafted DNS response. (CVE-2016-9147)

  - A denial of service flaw was found in the way BIND     handled an unusually-formed DS record response. A     remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response. (CVE-2016-9444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several denial of service vulnerabilities (assertion failures) were discovered in BIND, a DNS server implementation.

CVE-2016-9131

A crafted upstream response to an ANY query could cause an assertion failure.

CVE-2016-9147

A crafted upstream response with self-contradicting DNSSEC data could cause an assertion failure.

CVE-2016-9444

Specially crafted upstream responses with a DS record could cause an assertion failure.

These vulnerabilities predominantly affect DNS servers providing recursive service. Client queries to authoritative-only servers cannot trigger these assertion failures. These vulnerabilities are present whether or not DNSSEC validation is enabled in the server configuration.

For Debian 7 'Wheezy', these problems have been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u14.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the instance of ISC BIND 9 running on the remote name server is 9.9.x prior to 9.9.9-P5 or 9.9.9-S7, 9.10.x prior to 9.10.4-P5, or 9.11.x prior to 9.11.0-P2. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in named due to     a flaw that is triggered during the handling of a     specially crafted answer packet in a response to an     RTYPE ANY query. An unauthenticated, remote attacker can     exploit this to cause an assertion failure and daemon     exit. Note that this vulnerability affects versions     9.4.0 to 9.6-ESV-R11-W1, 9.8.5 to 9.8.8, 9.9.3 to     9.9.9-P4, 9.9.9-S1 to 9.9.9-S6, 9.10.0 to 9.10.4-P4, and     9.11.0 to 9.11.0-P1. (CVE-2016-9131)

  - A denial of service vulnerability exists in named in     DNSSEC-enabled authoritative servers that is triggered     during the handling of a query response that contains     inconsistent DNSSEC information. An unauthenticated,     remote attacker can exploit this to cause an assertion     failure and daemon exit. Note that this vulnerability     affects versions 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and     9.11.0-P1. (CVE-2016-9147)

  - A denial of service vulnerability exists in named due to     a flaw that is triggered during the handling of a     specially crafted answer that contains a DS resource     record. An unauthenticated, remote attacker can exploit     this to cause an assertion failure and daemon exit. Note     that this vulnerability affects versions 9.6-ESV-R9 to     9.6-ESV-R11-W1, 9.8.5 to 9.8.8, 9.9.3 to 9.9.9-P4,     9.9.9-S1 to 9.9.9-S6, 9.10.0 to 9.10.4-P4, and 9.11.0 to     9.11.0-P1. (CVE-2016-9444)

  - A denial of service vulnerability exists in named in the     nxdomain-redirect functionality that is triggered when     handling a specially crafted query. An unauthenticated,     remote attacker can exploit this to cause a REQUIRE     assertion failure and daemon exit. Note that this     vulnerability affects versions 9.9.8-S1 to 9.9.8-S3,     9.9.9-S1 to 9.9.9-S6, and 9.11.0-9.11.0 to P1.
    (CVE-2016-9778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0062 advisory.

    - Fix CVE-2016-9131 (ISC change 4508)
    - Fix CVE-2016-9147 (ISC change 4510)
    - Fix regression introduced by CVE-2016-8864 (ISC change 4530)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

Red Hat would like to thank ISC for reporting these issues.

Security Fix(es) :

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly with     an assertion failure via a specially crafted DNS     response. (CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     handled a query response containing inconsistent DNSSEC     information. A remote attacker could use this flaw to     make named exit unexpectedly with an assertion failure     via a specially crafted DNS response. (CVE-2016-9147)

  - A denial of service flaw was found in the way BIND     handled an unusually- formed DS record response. A     remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response. (CVE-2016-9444)

Security fix for CVE-2016-9131, CVE-2016-9147, CVE-2016-9444

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3172-1 advisory.

    It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2016-9131)

    It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2016-9147)

    It was discovered that Bind incorrectly handled certain malformed DS record responses. A remote attacker     could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9444)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ISC reports :

A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.

Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers.
DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.

An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.

named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.(CVE-2016-9131)

Impact

When the BIND recursion option is enabled, an attacker may exploit this vulnerability to cause the named process to restart.
Additionally, the restarted process does not trigger the BIG-IP system high availability (HA) failover event.

By default, the BIND recursion option is not enabled on BIG-IP DNS or GTM systems. If the BIND recursion option is enabled, BIG-IP DNS or GTM systems are vulnerable.

Several denial-of-service vulnerabilities (assertion failures) were discovered in BIND, a DNS server implementation.

  - CVE-2016-9131     A crafted upstream response to an ANY query could cause     an assertion failure.

  - CVE-2016-9147     A crafted upstream response with self-contradicting     DNSSEC data could cause an assertion failure.

  - CVE-2016-9444     Specially crafted upstream responses with a DS record     could cause an assertion failure.

These vulnerabilities predominantly affect DNS servers providing recursive service. Client queries to authoritative-only servers cannot trigger these assertion failures. These vulnerabilities are present whether or not DNSSEC validation is enabled in the server configuration.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

  - Fixed ldapdump to use a temporary pseudo nameserver that     conforms to BIND's expected syntax. Prior versions would     not work correctly with an LDAP backed DNS server.
    [bsc#965748]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124936	EulerOS Virtualization 3.0.1.0 : bind (EulerOS-SA-2019-1433)	Nessus	Huawei Local Security Checks	medium
102531	GLSA-201708-01 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
102127	AIX bind Advisory : bind_advisory15.asc (IV93361) (IV93362) (IV93363) (IV93365) (IV93366) (IV93403)	Nessus	AIX Local Security Checks	high
101407	Virtuozzo 7 : bind / bind-chroot / bind-devel / bind-libs / etc (VZLSA-2017-0062)	Nessus	Virtuozzo Local Security Checks	high
101100	RHEL 7 : bind (RHSA-2017:1583)	Nessus	Red Hat Local Security Checks	high
99871	EulerOS 2.0 SP2 : bind (EulerOS-SA-2017-1026)	Nessus	Huawei Local Security Checks	high
99870	EulerOS 2.0 SP1 : bind (EulerOS-SA-2017-1025)	Nessus	Huawei Local Security Checks	high
96840	Debian DLA-805-1 : bind9 security update	Nessus	Debian Local Security Checks	high
96625	ISC BIND 9 < 9.9.9-P5 / 9.9.9-S7 / 9.10.4-P5 / 9.11.0-P2 Multiple DoS	Nessus	DNS	high
96621	openSUSE Security Update : bind (openSUSE-2017-114)	Nessus	SuSE Local Security Checks	high
96584	Oracle Linux 7 : bind (ELSA-2017-0062)	Nessus	Oracle Linux Local Security Checks	high
96581	openSUSE Security Update : bind (openSUSE-2017-109)	Nessus	SuSE Local Security Checks	high
96567	CentOS 7 : bind (CESA-2017:0062)	Nessus	CentOS Local Security Checks	high
96563	Scientific Linux Security Update : bind on SL7.x x86_64 (20170116)	Nessus	Scientific Linux Local Security Checks	high
96540	Fedora 24 : bind99 (2017-8f23f564ad)	Nessus	Fedora Local Security Checks	high
96538	Fedora 24 : 32:bind (2017-59ca54c94e)	Nessus	Fedora Local Security Checks	high
96523	RHEL 7 : bind (RHSA-2017:0062)	Nessus	Red Hat Local Security Checks	high
96508	Fedora 25 : bind99 (2017-f44f2f5a48)	Nessus	Fedora Local Security Checks	high
96503	Fedora 25 : 32:bind (2017-87992a0557)	Nessus	Fedora Local Security Checks	high
96483	Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerabilities (USN-3172-1)	Nessus	Ubuntu Local Security Checks	high
96473	FreeBSD : BIND -- multiple vulnerabilities (d4c7e9a9-d893-11e6-9b4d-d050996490d0)	Nessus	FreeBSD Local Security Checks	high
96464	F5 Networks BIG-IP : BIND vulnerability (K86272821)	Nessus	F5 Networks Local Security Checks	high
96460	Debian DSA-3758-1 : bind9 - security update	Nessus	Debian Local Security Checks	high
96435	SUSE SLES12 Security Update : bind (SUSE-SU-2017:0113-1)	Nessus	SuSE Local Security Checks	high
96434	SUSE SLES11 Security Update : bind (SUSE-SU-2017:0112-1)	Nessus	SuSE Local Security Checks	high
96433	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2017:0111-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-9131

high

Tenable Plugins

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high