If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

An update of the bindutils package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the bind-9.16.23-13.el9 build changelog.

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-c0ff5a2f68 advisory.

    # Update to BIND 9.18.16

    Selected parts from [upstream release     notes](https://downloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-bind-9-18-16). Visit     that for details of bug fixes.

    ## Security Fixes

    -    The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the     configured max-cache-size limit. (CVE-2023-2828)

        ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv     University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing     this vulnerability to our attention. [GL #4055]

    -    A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache.
    If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite     callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089]

    ## New Features

    -    The system test suite can now be executed with pytest (along with pytest-xdist for parallel     execution). [GL #3978]

    ## Removed Features

    -    TKEY mode 2 (Diffie-Hellman Exchanged Keying) is now deprecated, and will be removed in a future     release. A warning will be logged when the tkey-dhkey option is used in named.conf. [GL #3905]


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-240 advisory.

    A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be     severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing     the configured max-cache-size limit to exceed significantly. (CVE-2023-2828)

    If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow.This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2836-1 advisory.

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-1d526d551c advisory.

    # Update to BIND 9.18.16

    Selected parts from [upstream release     notes](https://downloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-bind-9-18-16). Visit     that for details of bug fixes.

    ## Security Fixes

    -    The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the     configured max-cache-size limit. (CVE-2023-2828)

        ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv     University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing     this vulnerability to our attention. [GL #4055]

    -    A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache.
    If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite     callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089]

    ## New Features

    -    The system test suite can now be executed with pytest (along with pytest-xdist for parallel     execution). [GL #3978]

    ## Removed Features

    -    TKEY mode 2 (Diffie-Hellman Exchanged Keying) is now deprecated, and will be removed in a future     release. A warning will be logged when the tkey-dhkey option is used in named.conf. [GL #3905]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2667-1 advisory.

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5439 advisory.

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-8e1ddb1fa2 advisory.

    # Update to BIND 9.18.16

    Selected parts from [upstream release     notes](https://downloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-bind-9-18-16). Visit     that for details of bug fixes.

    ## Security Fixes

    -    The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the     configured max-cache-size limit. (CVE-2023-2828)

        ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv     University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing     this vulnerability to our attention. [GL #4055]

    -    A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache.
    If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite     callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089]

    ## New Features

    -    The system test suite can now be executed with pytest (along with pytest-xdist for parallel     execution). [GL #3978]

    ## Removed Features

    -    TKEY mode 2 (Diffie-Hellman Exchanged Keying) is now deprecated, and will be removed in a future     release. A warning will be logged when the tkey-dhkey option is used in named.conf. [GL #3905]


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.16.42 / 9.18.16. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-172-01 advisory.

  - If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable     yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named`     to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33     through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2911)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6183-1 advisory.

    Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled     the cache size limit. A remote attacker could possibly use this issue to consume memory, leading to a     denial of service. (CVE-2023-2828)

    It was discovered that Bind incorrectly handled the recursive-clients quota. A remote attacker could     possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-2911)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2023-2911 advisory.

  - If the  recursive-clients  quota is reached on a BIND 9 resolver configured with both  stale-answer-enable     yes;  and  stale-answer-client-timeout 0; , a sequence of serve-stale-related lookups could cause  named     to loop and terminate unexpectedly due to a stack overflow.By sending specific queries to the resolver, an     attacker can cause  named  to terminate unexpectedly. (CVE-2023-2911)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204566	Photon OS 4.0: Bindutils PHSA-2023-4.0-0417	Nessus	PhotonOS Local Security Checks	high
204528	Photon OS 5.0: Bindutils PHSA-2023-5.0-0037	Nessus	PhotonOS Local Security Checks	high
203878	Photon OS 3.0: Bindutils PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	high
191281	CentOS 9 : bind-9.16.23-13.el9	Nessus	CentOS Local Security Checks	high
188933	EulerOS 2.0 SP11 : bind (EulerOS-SA-2023-2837)	Nessus	Huawei Local Security Checks	high
188840	EulerOS 2.0 SP11 : bind (EulerOS-SA-2023-2854)	Nessus	Huawei Local Security Checks	high
188735	EulerOS Virtualization 2.11.1 : bind (EulerOS-SA-2023-3051)	Nessus	Huawei Local Security Checks	high
188703	EulerOS Virtualization 2.11.0 : bind (EulerOS-SA-2023-3068)	Nessus	Huawei Local Security Checks	high
185197	Fedora 39 : bind / bind-dyndb-ldap (2023-c0ff5a2f68)	Nessus	Fedora Local Security Checks	high
178605	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-240)	Nessus	Amazon Linux Local Security Checks	high
178316	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bind (SUSE-SU-2023:2836-1)	Nessus	SuSE Local Security Checks	high
177800	Fedora 37 : bind / bind-dyndb-ldap (2023-1d526d551c)	Nessus	Fedora Local Security Checks	high
177730	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bind (SUSE-SU-2023:2667-1)	Nessus	SuSE Local Security Checks	high
177627	Debian DSA-5439-1 : bind9 - security update	Nessus	Debian Local Security Checks	high
177597	Fedora 38 : bind / bind-dyndb-ldap (2023-8e1ddb1fa2)	Nessus	Fedora Local Security Checks	high
177532	Slackware Linux 15.0 / current bind Vulnerability (SSA:2023-172-01)	Nessus	Slackware Local Security Checks	high
177476	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Bind vulnerabilities (USN-6183-1)	Nessus	Ubuntu Local Security Checks	high
177465	ISC BIND 9.16.33 < 9.16.42 / 9.16.33-S1 < 9.16.42-S1 / 9.18.7 < 9.18.16 / 9.18.11-S1 < 9.18.16-S1 Vulnerability (cve-2023-2911)	Nessus	DNS	high

Detections

Analytics

CVE-2023-2911

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high