Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected:
BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition.
Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465. (CVE-2019-6465)

Impact

BIG-IP

An attacker can exploit this vulnerabilitytorequest and receive a zonetransfer of a DLZ that bypassestheallow-transfer accesscontrol list.

BIG-IQ, F5 iWorkflow, and Enterprise Manager

These F5 products are not vulnerablein the default, standard, and recommended configurations. This vulnerability is exposed on these products when a custom configurationis applied to the named service.

Traffix SDC

There is no impact for this F5 product; it is not affected by this vulnerability.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1061 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: TCP Pipelining doesn't limit TCP clients on a single connection (CVE-2019-6477)

    * bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using     managed-keys (CVE-2018-5745)

    * bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable     (CVE-2019-6465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1061 advisory.

  - managed-keys is a feature which allows a BIND resolver to automatically maintain the keys used by trust     anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys     feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if,     during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm.
    Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions     9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for     vulnerability to CVE-2018-5745. (CVE-2018-5745)

  - Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones     are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and     versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for     vulnerability to CVE-2019-6465. (CVE-2019-6465)

  - With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to     a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection     to a server could consume more resources than the server has been provisioned to handle. When a TCP     connection with a large number of pipelined queries is closed, the load on the server releasing these     multiple resources can cause it to become unresponsive, even for queries that can be answered     authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
    (CVE-2019-6477)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* bind: TCP Pipelining doesn't limit TCP clients on a single connection * bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys * bind:
Controls for zone transfers may not be properly applied to DLZs if the zones are writable

ID	名稱	產品	系列	已發布	已更新	嚴重性
122553	F5 Networks BIG-IP : BIND vulnerability (K01713115)	Nessus	F5 Networks Local Security Checks	2019/3/4	2026/10/21	medium
135069	RHEL 7 : bind (RHSA-2020:1061)	Nessus	Red Hat Local Security Checks	2020/4/1	2024/11/7	medium
135328	CentOS 7 : bind (RHSA-2020:1061)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	medium
135801	Scientific Linux Security Update : bind on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	2020/4/21	2020/4/24	medium

偵測

搜尋 Plugin

medium

medium

medium

medium