It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-010 advisory.

    A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the     forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to     obtain and pass on potentially incorrect answers. This flaw allows a remote attacker to manipulate cache     results with incorrect records, leading to queries made to the wrong servers, possibly resulting in false     information received on the client's end. (CVE-2021-25220)

    A flaw was found in Bind that incorrectly handles certain crafted TCP streams. The vulnerability allows     TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream     sent from a client. This flaw allows a remote attacker to send specially crafted TCP streams with keep-     response-order enabled that could cause connections to BIND to remain in CLOSE_WAIT status for an     indefinite period, even after the client has terminated the connection. This issue results in BIND     consuming resources, leading to a denial of service. (CVE-2022-0396)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-010)

medium Nessus Plugin ID 173114

Version 1.2