A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bind: Improper fetch cleanup sequencing in the resolver can cause named to crash (CVE-2017-3145)

  - ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the     named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a     long request that uses the lightweight resolver protocol. (CVE-2016-2775)

  - ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS     servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly     allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows     remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE     message. (CVE-2016-6170)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote NewStart CGSL host, running version MAIN 4.05, has bind packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way BIND handled TSIG     authentication for dynamic updates. A remote attacker     able to communicate with an authoritative BIND server     could use this flaw to manipulate the contents of a     zone, by forging a valid TSIG or SIG(0) signature for a     dynamic update request. (CVE-2017-3143)

  - A flaw was found in the way BIND handled TSIG     authentication of AXFR requests. A remote attacker, able     to communicate with an authoritative BIND server, could     use this flaw to view the entire contents of a zone by     sending a specially constructed request packet.
    (CVE-2017-3142)

  - A denial of service flaw was found in the way BIND     handled DNSSEC validation. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS response.
    (CVE-2017-3139)

  - A denial of service flaw was found in the way BIND     handled a query response containing CNAME or DNAME     resource records in an unusual order. A remote attacker     could use this flaw to make named exit unexpectedly with     an assertion failure via a specially crafted DNS     response. (CVE-2017-3137)

  - It was found that the lightweight resolver protocol     implementation in BIND could enter an infinite recursion     and crash when asked to resolve a query name which, when     combined with a search list entry, exceeds the maximum     allowable length. A remote attacker could use this flaw     to crash lwresd or named when using the lwres     statement in named.conf. (CVE-2016-2775)

  - A denial of service flaw was found in the way BIND     handled query requests when using DNS64 with break-     dnssec yes option. A remote attacker could use this     flaw to make named exit unexpectedly with an assertion     failure via a specially crafted DNS request.
    (CVE-2017-3136)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3139)

Note: This issue affected only the BIND versions as shipped with Red Hat Enterprise Linux 6. This issue did not affect any upstream versions of BIND.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1582 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME     resource records in an unusual order. A remote attacker could use this flaw to make named exit     unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3137)

    * A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could     use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS     response. (CVE-2017-3139)

    Red Hat would like to thank ISC for reporting CVE-2017-3137.

    Bug Fix(es):

    * ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017.
    Maintaining an up-to-date KSK, by adding the new root zone KSK, is essential for ensuring that validating     DNS resolvers continue to function following the rollover. (BZ#1458229, BZ#1458230, BZ#1458231,     BZ#1458232, BZ#1458233)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in the way BIND handled DNSSEC validation.

A remote attacker could use this flaw to make named exit unexpectedly with an

assertion failure via a specially crafted DNS response.
(CVE-2017-3139)

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3139)

Note: This issue affected only the BIND versions as shipped with Red Hat Enterprise Linux 6. This issue did not affect any upstream versions of BIND.

Security Fix(es) :

  - A denial of service flaw was found in the way BIND     handled DNSSEC validation. A remote attacker could use     this flaw to make named exit unexpectedly with an     assertion failure via a specially crafted DNS response.
    (CVE-2017-3139)

Note: This issue affected only the BIND versions as shipped with EL6.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1202 advisory.

    [32:9.8.2-0.62.rc1.2]
    - Fix DNSKEY that encountered a CNAME (#1447869, ISC change 3391)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199182	RHEL 5 : bind (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
127330	NewStart CGSL MAIN 4.05 : bind Multiple Vulnerabilities (NS-SA-2019-0102)	Nessus	NewStart CGSL Local Security Checks	medium
101461	Virtuozzo 6 : bind / bind-chroot / bind-devel / bind-libs / etc (VZLSA-2017-1202)	Nessus	Virtuozzo Local Security Checks	high
101099	RHEL 6 : bind (RHSA-2017:1582)	Nessus	Red Hat Local Security Checks	high
100553	Amazon Linux AMI : bind (ALAS-2017-833)	Nessus	Amazon Linux Local Security Checks	high
100066	CentOS 6 : bind (CESA-2017:1202)	Nessus	CentOS Local Security Checks	high
100048	Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20170508)	Nessus	Scientific Linux Local Security Checks	high
100047	RHEL 6 : bind (RHSA-2017:1202)	Nessus	Red Hat Local Security Checks	high
100046	Oracle Linux 6 : bind (ELSA-2017-1202)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2017-3139

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high