named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer.

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - BIND (Berkeley Internet Name Domain) is an     implementation of the DNS (Domain Name System)     protocols. BIND includes a DNS server (named), which     resolves host names to IP addresses a resolver library     (routines for applications to use when interfacing with     DNS) and tools for verifying that the DNS server is     operating properly.Security Fix(es):A buffer overflow     flaw was found in the SPNEGO implementation used by     BIND. This flaw allows a remote attacker to cause the     named process to crash or possibly perform remote code     execution. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system     availability.(CVE-2020-8625)named in ISC BIND 9.9.9-P4,     9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote     attackers to cause a denial of service (assertion     failure and daemon exit) via a response containing an     inconsistency among the DNSSEC-related     RRsets.(CVE-2016-9147)Under some conditions when using     both DNS64 and RPZ to rewrite query responses, query     processing can resume in an inconsistent state leading     to either an INSIST assertion failure or an attempt to     read through a NULL pointer. Affects BIND 9.8.8,     9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1,     9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2,     9.11.1b1.(CVE-2017-3135)Mistaken assumptions about the     ordering of records in the answer section of a response     containing CNAME or DNAME resource records could lead     to a situation in which named would exit with an     assertion failure when processing a response in which     records occurred in an unusual order. Affects BIND     9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6,     9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1,     and 9.9.9-S8.(CVE-2017-3137)apl_42.c in ISC BIND 9.x     before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3     allows remote authenticated users to cause a denial of     service (INSIST assertion failure and daemon exit) via     a malformed Address Prefix List (APL)     record.(CVE-2015-8704)named in ISC BIND 9.x before     9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before     9.11.0-P2 allows remote attackers to cause a denial of     service (assertion failure and daemon exit) via a     crafted DS resource record in an answer.(CVE-2016-9444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201708-01 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted DNS request to the BIND       resolver resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

Red Hat would like to thank ISC for reporting these issues.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for bind is now available for Red Hat Enterprise Linux 7.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-8864)

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

* A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3137)

Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Tony Finch (University of Cambridge) and Marco Davids (SIDN Labs) as the original reporters of CVE-2016-8864.

Bug Fix(es) :

* ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017. Maintaining an up-to-date KSK is essential for ensuring that validating DNS resolvers continue to function following the rollover. (BZ#1459648)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way BIND     handled query responses when both DNS64 and RPZ were     used. A remote attacker could use this flaw to make     named exit unexpectedly with an assertion failure or a     null pointer dereference via a specially crafted DNS     response. (CVE-2017-3135)

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly     with an assertion failure via a specially crafted DNS     response. (CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     handled a query response containing inconsistent DNSSEC     information. A remote attacker could use this flaw to     make named exit unexpectedly with an assertion failure     via a specially crafted DNS response. (CVE-2016-9147)

  - A denial of service flaw was found in the way BIND     handled an unusually-formed DS record response. A     remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response. (CVE-2016-9444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several denial of service vulnerabilities (assertion failures) were discovered in BIND, a DNS server implementation.

CVE-2016-9131

A crafted upstream response to an ANY query could cause an assertion failure.

CVE-2016-9147

A crafted upstream response with self-contradicting DNSSEC data could cause an assertion failure.

CVE-2016-9444

Specially crafted upstream responses with a DS record could cause an assertion failure.

These vulnerabilities predominantly affect DNS servers providing recursive service. Client queries to authoritative-only servers cannot trigger these assertion failures. These vulnerabilities are present whether or not DNSSEC validation is enabled in the server configuration.

For Debian 7 'Wheezy', these problems have been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u14.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the instance of ISC BIND 9 running on the remote name server is 9.9.x prior to 9.9.9-P5 or 9.9.9-S7, 9.10.x prior to 9.10.4-P5, or 9.11.x prior to 9.11.0-P2. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in named due to     a flaw that is triggered during the handling of a     specially crafted answer packet in a response to an     RTYPE ANY query. An unauthenticated, remote attacker can     exploit this to cause an assertion failure and daemon     exit. Note that this vulnerability affects versions     9.4.0 to 9.6-ESV-R11-W1, 9.8.5 to 9.8.8, 9.9.3 to     9.9.9-P4, 9.9.9-S1 to 9.9.9-S6, 9.10.0 to 9.10.4-P4, and     9.11.0 to 9.11.0-P1. (CVE-2016-9131)

  - A denial of service vulnerability exists in named in     DNSSEC-enabled authoritative servers that is triggered     during the handling of a query response that contains     inconsistent DNSSEC information. An unauthenticated,     remote attacker can exploit this to cause an assertion     failure and daemon exit. Note that this vulnerability     affects versions 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and     9.11.0-P1. (CVE-2016-9147)

  - A denial of service vulnerability exists in named due to     a flaw that is triggered during the handling of a     specially crafted answer that contains a DS resource     record. An unauthenticated, remote attacker can exploit     this to cause an assertion failure and daemon exit. Note     that this vulnerability affects versions 9.6-ESV-R9 to     9.6-ESV-R11-W1, 9.8.5 to 9.8.8, 9.9.3 to 9.9.9-P4,     9.9.9-S1 to 9.9.9-S6, 9.10.0 to 9.10.4-P4, and 9.11.0 to     9.11.0-P1. (CVE-2016-9444)

  - A denial of service vulnerability exists in named in the     nxdomain-redirect functionality that is triggered when     handling a specially crafted query. An unauthenticated,     remote attacker can exploit this to cause a REQUIRE     assertion failure and daemon exit. Note that this     vulnerability affects versions 9.9.8-S1 to 9.9.8-S3,     9.9.9-S1 to 9.9.9-S6, and 9.11.0-9.11.0 to P1.
    (CVE-2016-9778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0062 advisory.

    - Fix CVE-2016-9131 (ISC change 4508)
    - Fix CVE-2016-9147 (ISC change 4510)
    - Fix regression introduced by CVE-2016-8864 (ISC change 4530)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9131)

* A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)

* A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9444)

Red Hat would like to thank ISC for reporting these issues.

Security Fix(es) :

  - A denial of service flaw was found in the way BIND     processed a response to an ANY query. A remote attacker     could use this flaw to make named exit unexpectedly with     an assertion failure via a specially crafted DNS     response. (CVE-2016-9131)

  - A denial of service flaw was found in the way BIND     handled a query response containing inconsistent DNSSEC     information. A remote attacker could use this flaw to     make named exit unexpectedly with an assertion failure     via a specially crafted DNS response. (CVE-2016-9147)

  - A denial of service flaw was found in the way BIND     handled an unusually- formed DS record response. A     remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially     crafted DNS response. (CVE-2016-9444)

Security fix for CVE-2016-9131, CVE-2016-9147, CVE-2016-9444

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3172-1 advisory.

    It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2016-9131)

    It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2016-9147)

    It was discovered that Bind incorrectly handled certain malformed DS record responses. A remote attacker     could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9444)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ISC reports :

A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.

Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers.
DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.

An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.

named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer.(CVE-2016-9444)

Impact

When the BIND recursion option is enabled, an attacker may exploit this vulnerability to cause the named process to restart.
Additionally, the restarted process does not trigger the BIG-IP system high availability (HA) failover event.

By default, the BIND recursion option is not enabled on BIG-IP DNS or GTM systems. If the BIND recursion option is enabled, BIG-IP DNS or GTM systems are vulnerable.

Several denial-of-service vulnerabilities (assertion failures) were discovered in BIND, a DNS server implementation.

  - CVE-2016-9131     A crafted upstream response to an ANY query could cause     an assertion failure.

  - CVE-2016-9147     A crafted upstream response with self-contradicting     DNSSEC data could cause an assertion failure.

  - CVE-2016-9444     Specially crafted upstream responses with a DS record     could cause an assertion failure.

These vulnerabilities predominantly affect DNS servers providing recursive service. Client queries to authoritative-only servers cannot trigger these assertion failures. These vulnerabilities are present whether or not DNSSEC validation is enabled in the server configuration.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

  - Fixed ldapdump to use a temporary pseudo nameserver that     conforms to BIND's expected syntax. Prior versions would     not work correctly with an LDAP backed DNS server.
    [bsc#965748]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

  - Fix a potential assertion failure that could have been     triggered by a malformed response to an ANY query,     thereby facilitating a denial-of-service attack.
    [CVE-2016-9131, bsc#1018700, bsc#1018699]

  - Fix a potential assertion failure that could have been     triggered by responding to a query with inconsistent     DNSSEC information, thereby facilitating a     denial-of-service attack. [CVE-2016-9147, bsc#1018701,     bsc#1018699]

  - Fix potential assertion failure that could have been     triggered by DNS responses that contain unusually-formed     DS resource records, facilitating a denial-of-service     attack. [CVE-2016-9444, bsc#1018702, bsc#1018699]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
147614	EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2021-1396)	Nessus	Huawei Local Security Checks	high
102531	GLSA-201708-01 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
101407	Virtuozzo 7 : bind / bind-chroot / bind-devel / bind-libs / etc (VZLSA-2017-0062)	Nessus	Virtuozzo Local Security Checks	high
101100	RHEL 7 : bind (RHSA-2017:1583)	Nessus	Red Hat Local Security Checks	high
99871	EulerOS 2.0 SP2 : bind (EulerOS-SA-2017-1026)	Nessus	Huawei Local Security Checks	high
99870	EulerOS 2.0 SP1 : bind (EulerOS-SA-2017-1025)	Nessus	Huawei Local Security Checks	high
96840	Debian DLA-805-1 : bind9 security update	Nessus	Debian Local Security Checks	high
96625	ISC BIND 9 < 9.9.9-P5 / 9.9.9-S7 / 9.10.4-P5 / 9.11.0-P2 Multiple DoS	Nessus	DNS	high
96621	openSUSE Security Update : bind (openSUSE-2017-114)	Nessus	SuSE Local Security Checks	high
96584	Oracle Linux 7 : bind (ELSA-2017-0062)	Nessus	Oracle Linux Local Security Checks	high
96581	openSUSE Security Update : bind (openSUSE-2017-109)	Nessus	SuSE Local Security Checks	high
96567	CentOS 7 : bind (CESA-2017:0062)	Nessus	CentOS Local Security Checks	high
96563	Scientific Linux Security Update : bind on SL7.x x86_64 (20170116)	Nessus	Scientific Linux Local Security Checks	high
96540	Fedora 24 : bind99 (2017-8f23f564ad)	Nessus	Fedora Local Security Checks	high
96538	Fedora 24 : 32:bind (2017-59ca54c94e)	Nessus	Fedora Local Security Checks	high
96523	RHEL 7 : bind (RHSA-2017:0062)	Nessus	Red Hat Local Security Checks	high
96508	Fedora 25 : bind99 (2017-f44f2f5a48)	Nessus	Fedora Local Security Checks	high
96503	Fedora 25 : 32:bind (2017-87992a0557)	Nessus	Fedora Local Security Checks	high
96483	Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerabilities (USN-3172-1)	Nessus	Ubuntu Local Security Checks	high
96473	FreeBSD : BIND -- multiple vulnerabilities (d4c7e9a9-d893-11e6-9b4d-d050996490d0)	Nessus	FreeBSD Local Security Checks	high
96463	F5 Networks BIG-IP : BIND vulnerability (K40181790)	Nessus	F5 Networks Local Security Checks	high
96460	Debian DSA-3758-1 : bind9 - security update	Nessus	Debian Local Security Checks	high
96435	SUSE SLES12 Security Update : bind (SUSE-SU-2017:0113-1)	Nessus	SuSE Local Security Checks	high
96434	SUSE SLES11 Security Update : bind (SUSE-SU-2017:0112-1)	Nessus	SuSE Local Security Checks	high
96433	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2017:0111-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-9444

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high