The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5235 advisory.

    Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2022-2795 Yehuda Afek,     Anat Bremler-Barr and Shani Stajnrod discovered that a flaw in the resolver code can cause named to spend     excessive amounts of time on processing large delegations, significantly degrade resolver performance and     result in denial of service. CVE-2022-3080 Maksym Odinintsev discovered that the resolver can crash when     stale cache and stale answers are enabled with a zero stale-answer-timeout. A remote attacker can take     advantage of this flaw to cause a denial of service (daemon crash) via specially crafted queries to the     resolver. CVE-2022-38177 It was discovered that the DNSSEC verification code for the ECDSA algorithm is     susceptible to a memory leak flaw. A remote attacker can take advantage of this flaw to cause BIND to     consume resources, resulting in a denial of service. CVE-2022-38178 It was discovered that the DNSSEC     verification code for the EdDSA algorithm is susceptible to a memory leak flaw. A remote attacker can take     advantage of this flaw to cause BIND to consume resources, resulting in a denial of service. For the     stable distribution (bullseye), these problems have been fixed in version 1:9.16.33-1~deb11u1. We     recommend that you upgrade your bind9 packages. For the detailed security status of bind9 please refer to     its security tracker page at: https://security-tracker.debian.org/tracker/bind9

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5235-1 : bind9 - security update

medium Nessus Plugin ID 165329

Version 1.4

Version 1.3

Version 1.4 Jan 24, 2025, 11:52 PM CVSS metrics ("Cvssv4 score" set to 6.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:U") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N") CVSSv2 severity (based on CVE-2022-2795, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202501242352
Version 1.3 Dec 2, 2022, 4:16 PM CVSS metrics ("CVSSv2 score" changed from "5.0" to "7.8") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSSv2 severity (based on CVE-2022-38178, severity increased from "Medium" to "High") Plugin Feed: 202212021616