According to the version of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A denial of service flaw was discovered in bind     versions that include the 'deny-answer-aliases'     feature. This flaw may allow a remote attacker to     trigger an INSIST assert in named leading to     termination of the process and a denial of service     condition.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has bind packages installed that are affected by a vulnerability:

  - A denial of service flaw was discovered in bind versions     that include the deny-answer-aliases feature. This     flaw may allow a remote attacker to trigger an INSIST     assert in named leading to termination of the process     and a denial of service condition. (CVE-2018-5740)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for bind fixes the following issues :

Security issues fixed :

CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).

CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (bsc#1126068).

CVE-2018-5743: Fixed a denial of service vulnerability which could be caused by to many simultaneous TCP connections (bsc#1133185).

CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

Security issues fixed :

CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).

CVE-2018-5745: An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys.
(bsc#1126068)

CVE-2018-5743: Limiting simultaneous TCP clients is ineffective.
(bsc#1133185)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

Security issues fixed :

  - CVE-2019-6465: Fixed an issue where controls for zone     transfers may not be properly applied to Dynamically     Loadable Zones (bsc#1126069).

  - CVE-2018-5745: Fixed a denial of service vulnerability     if a trust anchor rolls over to an unsupported key     algorithm when using managed-keys (bsc#1126068).

  - CVE-2018-5743: Fixed a denial of service vulnerability     which could be caused by to many simultaneous TCP     connections (bsc#1133185).

  - CVE-2018-5740: Fixed a denial of service vulnerability     in the 'deny-answer-aliases' feature (bsc#1104129).

This update was imported from the SUSE:SLE-15:Update update project.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is 9.x.x prior to 9.9.13-P1, 9.10.x prior to 9.10.8-P1, 9.11.x prior to 9.11.4-P1, or 9.12.x prior to 9.12.2-P1. It is, therefore, affected by a denial of service vulnerability in the deny-answer-aliases feature.

Update to 9.11.4-P1

  - Fixes CVE-2018-5738

  - Adds root key sentinel mechanism support

  - incremental zone transfer limit to prevent journal     corruption

  - rndc reload memory leak

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2570 advisory.

  - bind: processing of certain records when deny-answer-aliases is in use may trigger an assert leading to     a denial of service (CVE-2018-5740)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for bind is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* bind: processing of certain records when 'deny-answer-aliases' is in use may trigger an assert leading to a denial of service (CVE-2018-5740)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank ISC for reporting this issue. Upstream acknowledges Tony Finch (University of Cambridge) as the original reporter.

CVE-2018-5740 The 'deny-answer-aliases' feature in BIND has a flaw which can cause named to exit with an assertion failure.

For Debian 8 'Jessie', this problem has been fixed in version 1:9.9.5.dfsg-9+deb8u16.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues :

Security issues fixed :

CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).

CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687)

CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (bsc#1126068).

CVE-2018-5743: Fixed a denial of service vulnerability which could be caused by to many simultaneous TCP connections (bsc#1133185).

CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

Non-security issues fixed: Don't rely on /etc/insserv.conf anymore for proper dependencies against nss-lookup.target in named.service and lwresd.service (bsc#1118367, bsc#1118368).

Fix FIPS related regression (bsc#1128220).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bind: An error in TSIG authentication can permit unauthorized dynamic updates (CVE-2017-3143)

  - named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation     and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion     failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in     which no key is ready for use. (CVE-2015-1349)

  - name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when     configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of     service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a     query for a name in that zone. (CVE-2015-4620)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
118416	EulerOS Virtualization 2.5.1 : bind (EulerOS-SA-2018-1328)	Nessus	Huawei Local Security Checks	10/26/2018	2/3/2022	high
127383	NewStart CGSL MAIN 4.05 : bind Vulnerability (NS-SA-2019-0130)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	high
125703	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2019:1407-1)	Nessus	SuSE Local Security Checks	6/4/2019	1/13/2021	medium
125799	SUSE SLES12 Security Update : bind (SUSE-SU-2019:1449-1)	Nessus	SuSE Local Security Checks	6/10/2019	1/13/2021	medium
125808	openSUSE Security Update : bind (openSUSE-2019-1533)	Nessus	SuSE Local Security Checks	6/11/2019	9/23/2020	medium
111790	ISC BIND 9.x.x < 9.9.13-P1 / 9.10.x < 9.10.8-P1 / 9.11.x < 9.11.4-P1 / 9.12.x < 9.12.2-P1 deny-answer-aliases DoS Vulnerability	Nessus	DNS	8/16/2018	11/4/2019	high
112068	Fedora 27 : 32:bind (2018-90f8fbd58e)	Nessus	Fedora Local Security Checks	8/23/2018	1/6/2021	high
112133	RHEL 7 : bind (RHSA-2018:2570)	Nessus	Red Hat Local Security Checks	8/28/2018	4/27/2024	high
112165	CentOS 6 : bind (CESA-2018:2571)	Nessus	CentOS Local Security Checks	8/29/2018	12/31/2019	high
112197	Debian DLA-1485-1 : bind9 security update	Nessus	Debian Local Security Checks	8/31/2018	1/11/2021	high
129526	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2019:2502-1)	Nessus	SuSE Local Security Checks	10/2/2019	1/13/2021	medium
199953	RHEL 5 : bind97 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

high

high

high

high

high

medium

medium