A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-56ae6c2c7a advisory.

    - update to 9.18.28 rhbz#2299467
    - Fixes CVE-2024-4076
    - Fixes CVE-2024-1975
    - Fixes CVE-2024-1737
    - Fixes CVE-2024-0760

    ----

    Automatic update for bind-9.18.28-1.fc41.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-ef8a7031e7 advisory.

    # Update to BIND 9.18.28

    ## Security Fixes

    -    A malicious DNS client that sent many queries over TCP but never read the responses could cause a     server to respond slowly or not at all for other clients. This has been fixed. (CVE-2024-0760) [GL #4481]

    -    It is possible to craft excessively large resource records sets, which have the effect of slowing     down database processing. This has been addressed by adding a configurable limit to the number of records     that can be stored per name and type in a cache or zone database. The default is 100, which can be tuned     with the new max-records-per-type option. [GL #497] [GL #3405]

        It is possible to craft excessively large numbers of resource record types for a given owner name,     which has the effect of slowing down database processing. This has been addressed by adding a configurable     limit to the number of records that can be stored per name and type in a cache or zone database. The     default is 100, which can be tuned with the new max-types-per-name option. (CVE-2024-1737) [GL #3403]

        ISC would like to thank Toshifumi Sakaguchi who independently discovered and responsibly reported the     issue to ISC. [GL #4548]

    -    Validating DNS messages signed using the SIG(0) protocol (RFC 2931) could cause excessive CPU load,     leading to a denial-of-service condition. Support for SIG(0) message validation was removed from this     version of named. (CVE-2024-1975) [GL #4480]

    -    Due to a logic error, lookups that triggered serving stale data and required lookups in local     authoritative zone data could have resulted in an assertion failure. This has been fixed. (CVE-2024-4076)     [GL #4507]

    Potential data races were found in our DoH implementation, related to HTTP/2 session object management and     endpoints set object management after reconfiguration. These issues have been fixed. [GL #4473]

    ISC would like to thank Dzintars and Ivo from nic.lv for bringing this to our attention.

    - When looking up the NS records of parent zones as part of looking up DS records, it was possible for     named to trigger an assertion failure if serve-stale was enabled. This has been fixed. [GL #4661]



    - https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-8af1780fdf advisory.

    # Update to BIND 9.18.28


    ## Security Fixes

    -    A malicious DNS client that sent many queries over TCP but never read the responses could cause a     server to respond slowly or not at all for other clients. This has been fixed. (CVE-2024-0760) [GL #4481]

    -    It is possible to craft excessively large resource records sets, which have the effect of slowing     down database processing. This has been addressed by adding a configurable limit to the number of records     that can be stored per name and type in a cache or zone database. The default is 100, which can be tuned     with the new max-records-per-type option. [GL #497] [GL #3405]

        It is possible to craft excessively large numbers of resource record types for a given owner name,     which has the effect of slowing down database processing. This has been addressed by adding a configurable     limit to the number of records that can be stored per name and type in a cache or zone database. The     default is 100, which can be tuned with the new max-types-per-name option. (CVE-2024-1737) [GL #3403]

        ISC would like to thank Toshifumi Sakaguchi who independently discovered and responsibly reported the     issue to ISC. [GL #4548]

    -    Validating DNS messages signed using the SIG(0) protocol (RFC 2931) could cause excessive CPU load,     leading to a denial-of-service condition. Support for SIG(0) message validation was removed from this     version of named. (CVE-2024-1975) [GL #4480]

    -    Due to a logic error, lookups that triggered serving stale data and required lookups in local     authoritative zone data could have resulted in an assertion failure. This has been fixed. (CVE-2024-4076)     [GL #4507]

    Potential data races were found in our DoH implementation, related to HTTP/2 session object management and     endpoints set object management after reconfiguration. These issues have been fixed. [GL #4473]

    ISC would like to thank Dzintars and Ivo from nic.lv for bringing this to our attention.

    - When looking up the NS records of parent zones as part of looking up DS records, it was possible for     named to trigger an assertion failure if serve-stale was enabled. This has been fixed. [GL #4661]

    - Source: https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2636-1 advisory.

    Update to release 9.18.28

    Security fixes:

    - CVE-2024-0760: Fixed a flood of DNS messages over TCP may make the server unstable (bsc#1228255)
    - CVE-2024-1737: Fixed BIND's database will be slow if a very large number of RRs exist at the same name     (bsc#1228256)
    - CVE-2024-1975: Fixed SIG(0) can be used to exhaust CPU resources (bsc#1228257)
    - CVE-2024-4076: Fixed assertion failure when serving both stale cache data and authoritative zone content     (bsc#1228258)

    Changelog:

      * Command-line options for IPv4-only (named -4) and IPv6-only         (named -6) modes are now respected for zone primaries,         also-notify, and parental-agents.
      * An RPZ responses SOA record TTL was set to 1 instead of the         SOA TTL, if add-soa was used. This has been fixed.
      * When a query related to zone maintenance (NOTIFY, SOA) timed         out close to a view shutdown (triggered e.g. by rndc reload),         named could crash with an assertion failure. This has been         fixed.
      * The statistics channel counters that indicated the number of         currently connected TCP IPv4/IPv6 clients were not properly         adjusted in certain failure scenarios. This has been fixed.
      * Some servers that could not be reached due to EHOSTDOWN or         ENETDOWN conditions were incorrectly prioritized during server         selection. These are now properly handled as unreachable.
      * On some systems the libuv call may return an error code when         sending a TCP reset for a connection, which triggers an         assertion failure in named. This error condition is now dealt         with in a more graceful manner, by logging the incident and         shutting down the connection.
      * Changes to listen-on statements were ignored on reconfiguration         unless the port or interface address was changed, making it         impossible to change a related listener transport type. That         issue has been fixed.
      * A bug in the keymgr code unintentionally slowed down some         DNSSEC key rollovers. This has been fixed.
      * Some ISO 8601 durations were accepted erroneously, leading to         shorter durations than expected. This has been fixed
      * A regression in cache-cleaning code enabled memory use to grow         significantly more quickly than before, until the configured         max-cache-size limit was reached. This has been fixed.
      * Using rndc flush inadvertently caused cache cleaning to become         less effective. This could ultimately lead to the configured         max-cache-size limit being exceeded and has now been fixed.
      * The logic for cleaning up expired cached DNS records was         tweaked to be more aggressive. This change helps with enforcing         max-cache-ttl and max-ncache-ttl in a timely manner.
      * It was possible to trigger a use-after-free assertion when the         overmem cache cleaning was initiated. This has been fixed.
      New Features:
      * A new option signatures-jitter has been added to dnssec-policy         to allow signature expirations to be spread out over a period         of time.
      * The statistics channel now includes counters that indicate the         number of currently connected TCP IPv4/IPv6 clients.
      * Added RESOLVER.ARPA to the built in empty zones.
      Feature Changes:
      * DNSSEC signatures that are not valid because the current time         falls outside the signature inception and expiration dates are         skipped instead of causing an immediate validation failure.
      Security Fixes:
      * A malicious DNS client that sent many queries over TCP but         never read the responses could cause a server to respond slowly         or not at all for other clients. This has been fixed.
        (CVE-2024-0760)
      * It is possible to craft excessively large resource records         sets, which have the effect of slowing down database         processing. This has been addressed by adding a configurable         limit to the number of records that can be stored per name and         type in a cache or zone database. The default is 100, which can         be tuned with the new max-records-per-type option.
      * It is possible to craft excessively large numbers of resource         record types for a given owner name, which has the effect of         slowing down database processing. This has been addressed by         adding a configurable limit to the number of records that can         be stored per name and type in a cache or zone database. The         default is 100, which can be tuned with the new         max-types-per-name option. (CVE-2024-1737)
      * Validating DNS messages signed using the SIG(0) protocol (RFC         2931) could cause excessive CPU load, leading to a         denial-of-service condition. Support for SIG(0) message         validation was removed from this version of named.
        (CVE-2024-1975)
      * Due to a logic error, lookups that triggered serving stale data         and required lookups in local authoritative zone data could         have resulted in an assertion failure. This has been fixed.
      * Potential data races were found in our DoH implementation,         related to HTTP/2 session object management and endpoints set         object management after reconfiguration. These issues have been         fixed.
      * When looking up the NS records of parent zones as part of         looking up DS records, it was possible for named to trigger an         assertion failure if serve-stale was enabled. This has been         fixed. (CVE-2024-4076)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5734 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5734-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 25, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2024-0760 CVE-2024-1737 CVE-2024-1975 CVE-2024-4076

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in denial of service.

    To mitigate CVE-2024-1737 two new configuration statements have been     added to allow operators of secondary servers and recursive resolvers to     set an upper bound on the growth of data in their zones or caches.
    Details can be found at:
    https://kb.isc.org/docs/rrset-limits-in-zones

    For the oldstable distribution (bullseye), these problems have been     fixed in version 1:9.16.50-1~deb11u1. For the oldstable distribution     (bullseye) the limits to mitigate CVE-2024-1737 are hardcoded and not     configurable.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:9.18.28-1~deb12u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

The version of bind installed on the remote host is prior to 9.18.28. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-205-01 advisory.

    New bind packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6909-1 advisory.

    It was discovered that Bind incorrectly handled a flood of DNS messages over TCP. A remote attacker could     possibly use this issue to cause Bind to become unstable, resulting in a denial of service.
    (CVE-2024-0760)

    Toshifumi Sakaguchi discovered that Bind incorrectly handled having a very large number of RRs existing at     the same time. A remote attacker could possibly use this issue to cause Bind to consume resources, leading     to a denial of service. (CVE-2024-1737)

    It was discovered that Bind incorrectly handled a large number of SIG(0) signed requests. A remote     attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service.
    (CVE-2024-1975)

    Daniel Strnger discovered that Bind incorrectly handled serving both stable cache data and authoritative     zone content. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. (CVE-2024-4076)

    On Ubuntu 20.04 LTS, Bind has been updated from 9.16 to 9.18. In addition to security fixes, the updated     packages contain bug fixes, new features, and possibly incompatible changes.

    Please see the following for more information:

    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211195	Fedora 41 : bind / bind-dyndb-ldap (2024-56ae6c2c7a)	Nessus	Fedora Local Security Checks	high
205743	Fedora 39 : bind / bind-dyndb-ldap (2024-ef8a7031e7)	Nessus	Fedora Local Security Checks	high
204983	Fedora 40 : bind / bind-dyndb-ldap (2024-8af1780fdf)	Nessus	Fedora Local Security Checks	high
204895	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bind (SUSE-SU-2024:2636-1)	Nessus	SuSE Local Security Checks	high
204745	Debian dsa-5734 : bind9 - security update	Nessus	Debian Local Security Checks	high
204655	Photon OS 4.0: Bindutils PHSA-2024-4.0-0657	Nessus	PhotonOS Local Security Checks	high
204653	Photon OS 5.0: Bindutils PHSA-2024-5.0-0330	Nessus	PhotonOS Local Security Checks	high
203670	Slackware Linux 15.0 / current bind Multiple Vulnerabilities (SSA:2024-205-01)	Nessus	Slackware Local Security Checks	high
203144	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Bind vulnerabilities (USN-6909-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2024-0760

high

Tenable Plugins

high

high

high

high

high

high

high

high

high