ID CVE-2015-1349
Summary named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
References
Vulnerable Configurations
  • ISC BIND 9.7.0
    cpe:2.3:a:isc:bind:9.7.0
  • ISC BIND 9.7.0 Beta 1
    cpe:2.3:a:isc:bind:9.7.0:b1
  • ISC BIND 9.7.0 p1
    cpe:2.3:a:isc:bind:9.7.0:p1
  • ISC BIND 9.7.0 p2
    cpe:2.3:a:isc:bind:9.7.0:p2
  • ISC BIND 9.7.0 Release Candidate 1
    cpe:2.3:a:isc:bind:9.7.0:rc1
  • ISC BIND 9.7.0 Release Candidate 2
    cpe:2.3:a:isc:bind:9.7.0:rc2
  • ISC BIND 9.7.1
    cpe:2.3:a:isc:bind:9.7.1
  • ISC BIND 9.7.1 p1
    cpe:2.3:a:isc:bind:9.7.1:p1
  • ISC BIND 9.7.1 p2
    cpe:2.3:a:isc:bind:9.7.1:p2
  • ISC BIND 9.7.1 Release Candidate 1
    cpe:2.3:a:isc:bind:9.7.1:rc1
  • ISC BIND 9.7.2
    cpe:2.3:a:isc:bind:9.7.2
  • ISC BIND 9.7.2 P1
    cpe:2.3:a:isc:bind:9.7.2:p1
  • ISC BIND 9.7.2 P2
    cpe:2.3:a:isc:bind:9.7.2:p2
  • ISC BIND 9.7.2 P3
    cpe:2.3:a:isc:bind:9.7.2:p3
  • ISC BIND 9.7.2 Release Candidate 1
    cpe:2.3:a:isc:bind:9.7.2:rc1
  • ISC BIND 9.7.3
    cpe:2.3:a:isc:bind:9.7.3
  • ISC BIND 9.7.3 B1
    cpe:2.3:a:isc:bind:9.7.3:b1
  • ISC BIND 9.7.3 P1
    cpe:2.3:a:isc:bind:9.7.3:p1
  • ISC BIND 9.7.3 Release Candidate 1
    cpe:2.3:a:isc:bind:9.7.3:rc1
  • ISC BIND 9.7.4
    cpe:2.3:a:isc:bind:9.7.4
  • ISC BIND 9.7.4 B1
    cpe:2.3:a:isc:bind:9.7.4:b1
  • ISC BIND 9.7.4P1
    cpe:2.3:a:isc:bind:9.7.4:p1
  • ISC BIND 9.7.4 Release Candidate 1
    cpe:2.3:a:isc:bind:9.7.4:rc1
  • ISC BIND 9.7.5
    cpe:2.3:a:isc:bind:9.7.5
  • ISC BIND 9.7.5 B1
    cpe:2.3:a:isc:bind:9.7.5:b1
  • ISC BIND 9.7.5 Release Candidate 1
    cpe:2.3:a:isc:bind:9.7.5:rc1
  • ISC BIND 9.7.5 Release Candidate 2
    cpe:2.3:a:isc:bind:9.7.5:rc2
  • ISC BIND 9.7.6
    cpe:2.3:a:isc:bind:9.7.6
  • ISC BIND 9.7.6-p1
    cpe:2.3:a:isc:bind:9.7.6:p1
  • ISC BIND 9.7.6-p2
    cpe:2.3:a:isc:bind:9.7.6:p2
  • ISC BIND 9.7.7
    cpe:2.3:a:isc:bind:9.7.7
  • ISC BIND 9.8.0
    cpe:2.3:a:isc:bind:9.8.0
  • ISC BIND 9.8.0 A1
    cpe:2.3:a:isc:bind:9.8.0:a1
  • ISC BIND 9.8.0 B1
    cpe:2.3:a:isc:bind:9.8.0:b1
  • ISC BIND 9.8.0 P1
    cpe:2.3:a:isc:bind:9.8.0:p1
  • ISC BIND 9.8.0 P2
    cpe:2.3:a:isc:bind:9.8.0:p2
  • ISC BIND 9.8.0-P4
    cpe:2.3:a:isc:bind:9.8.0:p4
  • ISC BIND 9.8.0 Release Candidate 1
    cpe:2.3:a:isc:bind:9.8.0:rc1
  • ISC BIND 9.8.1
    cpe:2.3:a:isc:bind:9.8.1
  • ISC BIND 9.8.1 B1
    cpe:2.3:a:isc:bind:9.8.1:b1
  • ISC BIND 9.8.1 B2
    cpe:2.3:a:isc:bind:9.8.1:b2
  • ISC BIND 9.8.1 B3
    cpe:2.3:a:isc:bind:9.8.1:b3
  • ISC BIND 9.8.1-P1
    cpe:2.3:a:isc:bind:9.8.1:p1
  • ISC BIND 9.8.1 Release Candidate 1
    cpe:2.3:a:isc:bind:9.8.1:rc1
  • ISC BIND 9.8.2 B1
    cpe:2.3:a:isc:bind:9.8.2:b1
  • ISC BIND 9.8.2 Release Candidate 1
    cpe:2.3:a:isc:bind:9.8.2:rc1
  • ISC BIND 9.8.2 Release Candidate 2
    cpe:2.3:a:isc:bind:9.8.2:rc2
  • ISC BIND 9.8.3
    cpe:2.3:a:isc:bind:9.8.3
  • ISC BIND 9.8.3-p1
    cpe:2.3:a:isc:bind:9.8.3:p1
  • ISC BIND 9.8.3-p2
    cpe:2.3:a:isc:bind:9.8.3:p2
  • ISC BIND 9.8.4
    cpe:2.3:a:isc:bind:9.8.4
  • ISC BIND 9.8.5
    cpe:2.3:a:isc:bind:9.8.5
  • ISC BIND 9.8.5 b1
    cpe:2.3:a:isc:bind:9.8.5:b1
  • ISC BIND 9.8.5 b2
    cpe:2.3:a:isc:bind:9.8.5:b2
  • ISC BIND 9.8.5 P1
    cpe:2.3:a:isc:bind:9.8.5:p1
  • ISC BIND 9.8.5 P2
    cpe:2.3:a:isc:bind:9.8.5:p2
  • ISC BIND 9.8.5 release candidate 1
    cpe:2.3:a:isc:bind:9.8.5:rc1
  • ISC BIND 9.8.5 release candidate 2
    cpe:2.3:a:isc:bind:9.8.5:rc2
  • ISC BIND 9.8.6b1
    cpe:2.3:a:isc:bind:9.8.6:b1
  • ISC BIND 9.8.6 release candidate 1
    cpe:2.3:a:isc:bind:9.8.6:rc1
  • ISC BIND 9.8.6 release candidate 2
    cpe:2.3:a:isc:bind:9.8.6:rc2
  • ISC BIND 9.9.0
    cpe:2.3:a:isc:bind:9.9.0
  • ISC BIND 9.9.0a1
    cpe:2.3:a:isc:bind:9.9.0:a1
  • ISC BIND 9.9.0a2
    cpe:2.3:a:isc:bind:9.9.0:a2
  • ISC BIND 9.9.0a3
    cpe:2.3:a:isc:bind:9.9.0:a3
  • ISC BIND 9.9.0b1
    cpe:2.3:a:isc:bind:9.9.0:b1
  • ISC BIND 9.9.0b2
    cpe:2.3:a:isc:bind:9.9.0:b2
  • ISC BIND 9.9.0 release candidate 1
    cpe:2.3:a:isc:bind:9.9.0:rc1
  • ISC BIND 9.9.0 release candidate 2
    cpe:2.3:a:isc:bind:9.9.0:rc2
  • ISC BIND 9.9.0 release candidate 3
    cpe:2.3:a:isc:bind:9.9.0:rc3
  • ISC BIND 9.9.0 release candidate 4
    cpe:2.3:a:isc:bind:9.9.0:rc4
  • ISC BIND 9.9.1
    cpe:2.3:a:isc:bind:9.9.1
  • ISC BIND 9.9.1-p1
    cpe:2.3:a:isc:bind:9.9.1:p1
  • ISC BIND 9.9.1-p2
    cpe:2.3:a:isc:bind:9.9.1:p2
  • ISC BIND 9.9.2
    cpe:2.3:a:isc:bind:9.9.2
  • ISC BIND 9.9.3
    cpe:2.3:a:isc:bind:9.9.3
  • ISC BIND 9.9.3 b1
    cpe:2.3:a:isc:bind:9.9.3:b1
  • ISC BIND 9.9.3 b2
    cpe:2.3:a:isc:bind:9.9.3:b2
  • ISC BIND 9.9.3p1
    cpe:2.3:a:isc:bind:9.9.3:p1
  • ISC BIND 9.9.3p2
    cpe:2.3:a:isc:bind:9.9.3:p2
  • ISC BIND 9.9.3 release candidate 1
    cpe:2.3:a:isc:bind:9.9.3:rc1
  • ISC BIND 9.9.3 release candidate 2
    cpe:2.3:a:isc:bind:9.9.3:rc2
  • ISC BIND 9.9.4b1
    cpe:2.3:a:isc:bind:9.9.4:b1
  • ISC BIND 9.9.5
    cpe:2.3:a:isc:bind:9.9.5
  • ISC BIND 9.9.6
    cpe:2.3:a:isc:bind:9.9.6
  • ISC BIND 9.9.6 p1
    cpe:2.3:a:isc:bind:9.9.6:p1
  • ISC BIND 9.9.7 b1
    cpe:2.3:a:isc:bind:9.9.7:b1
  • ISC BIND 9.10.0
    cpe:2.3:a:isc:bind:9.10.0
  • ISC BIND 9.10.1
    cpe:2.3:a:isc:bind:9.10.1
  • ISC BIND 9.10.1 p1
    cpe:2.3:a:isc:bind:9.10.1:p1
  • ISC BIND 9.10.2 b2
    cpe:2.3:a:isc:bind:9.10.2:b1
  • ISC BIND 9.10.2 Release Candidate 1
    cpe:2.3:a:isc:bind:9.10.2:rc1
CVSS
Base: 5.4 (as of 08-07-2016 - 12:16)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-2548.NASL
    description This update fixes : - Bug #1193820 - CVE-2015-1349 bind: issue in trust anchor management can cause named to crash Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 81657
    published 2015-03-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81657
    title Fedora 20 : bind-9.9.4-18.P2.fc20 (2015-2548)
  • NASL family DNS
    NASL id BIND9_9101_P2.NASL
    description According to its self-reported version number, the remote installation of BIND is potentially affected by a denial of service vulnerability due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81486
    published 2015-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81486
    title ISC BIND 9.10.x < 9.10.1-P2 DNSSEC Validation DoS
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-2543.NASL
    description This update fixes : - Bug #1193820 - CVE-2015-1349 bind: issue in trust anchor management can cause named to crash Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 81656
    published 2015-03-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81656
    title Fedora 21 : bind-9.9.6-8.P1.fc21 (2015-2543)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-494.NASL
    description bind was updated to fix three security issues. These security issues were fixed : - CVE-2015-1349: named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allowed remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use (bsc#918330). - CVE-2014-8500: ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 did not limit delegation chaining, which allowed remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals (bsc#908994). - CVE-2015-4620: Resolver crash when validating (bsc#936476).
    last seen 2019-02-21
    modified 2015-09-13
    plugin id 84816
    published 2015-07-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84816
    title openSUSE Security Update : bind (openSUSE-2015-494)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-1205-1.NASL
    description bind was updated to fix two security issues : CVE-2015-1349: A problem with trust anchor management could have caused named to crash (bsc#918330). CVE-2015-4620: Fix resolver crash when validating (bsc#936476). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 84633
    published 2015-07-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84633
    title SUSE SLED11 / SLES11 Security Update : bind (SUSE-SU-2015:1205-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-1204-1.NASL
    description bind was updated to fix two security issues. These security issues were fixed : - CVE-2015-1349: Named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allowed remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use (bsc#918330). - CVE-2015-4620: Fixed resolver crash when validating (bsc#936476). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 84632
    published 2015-07-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84632
    title SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2015:1204-1)
  • NASL family DNS
    NASL id BIND9_996_P2.NASL
    description According to its self-reported version number, the remote installation of BIND is potentially affected by a denial of service vulnerability due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81489
    published 2015-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81489
    title ISC BIND 9.7.0.x < 9.9.6-P2 DNSSEC Validation DoS
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2015-490.NASL
    description A flaw was found in the way BIND handled trust anchor management. A remote attacker could use this flaw to cause the BIND daemon (named) to crash under certain conditions.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 81826
    published 2015-03-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81826
    title Amazon Linux AMI : bind (ALAS-2015-490)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-054.NASL
    description Updated bind packages fix security vulnerability : Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-lookaside auto\;' (as enabled in the Mageia default configuration) or 'dnssec-validation auto\;' (CVE-2015-1349).
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 81937
    published 2015-03-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81937
    title Mandriva Linux Security Advisory : bind (MDVSA-2015:054)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3162.NASL
    description Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-validation auto;' (as enabled in the Debian default configuration) or 'dnssec-lookaside auto;'.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81409
    published 2015-02-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81409
    title Debian DSA-3162-1 : bind9 - security update
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2503-1.NASL
    description Jan-Piet Mens discovered that Bind incorrectly handled Trust Anchor Management. A remote attacker could use this issue to cause bind to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 81412
    published 2015-02-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81412
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : bind9 vulnerability (USN-2503-1)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_58033A95BBA811E488AED050992ECDE8.NASL
    description ISC reports : When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors.
    last seen 2019-02-21
    modified 2018-12-19
    plugin id 81462
    published 2015-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81462
    title FreeBSD : bind -- denial of service vulnerability (58033a95-bba8-11e4-88ae-d050992ecde8)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2015-111-01.NASL
    description New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 82914
    published 2015-04-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82914
    title Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-111-01)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-165.NASL
    description Updated bind packages fix security vulnerabilities : By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and denial of service (up to and including termination of the named server process) (CVE-2014-8500). Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-lookaside auto;' (as enabled in the Mandriva default configuration) or 'dnssec-validation auto;' (CVE-2015-1349).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 82418
    published 2015-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82418
    title Mandriva Linux Security Advisory : bind (MDVSA-2015:165)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150311_BIND_ON_SL6_X.NASL
    description A flaw was found in the way BIND handled trust anchor management. A remote attacker could use this flaw to cause the BIND daemon (named) to crash under certain conditions. (CVE-2015-1349) After installing the update, the BIND daemon (named) will be restarted automatically.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 81770
    published 2015-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81770
    title Scientific Linux Security Update : bind on SL6.x, SL7.x i386/x86_64
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2015-0033.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Fix (CVE-2015-1349)
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 81948
    published 2015-03-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81948
    title OracleVM 3.3 : bind (OVMSA-2015-0033)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0672.NASL
    description Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. A flaw was found in the way BIND handled trust anchor management. A remote attacker could use this flaw to cause the BIND daemon (named) to crash under certain conditions. (CVE-2015-1349) Red Hat would like to thank ISC for reporting this issue. All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.
    last seen 2019-02-21
    modified 2018-12-07
    plugin id 81750
    published 2015-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81750
    title RHEL 7 : bind (RHSA-2015:0672)
  • NASL family DNS
    NASL id BIND9_996_S3_DNSCO.NASL
    description According to its self-reported version number, the remote installation of BIND (via DNSco) is potentially affected by a denial of service vulnerability due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81488
    published 2015-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81488
    title ISC BIND 9.9.6-S2 DNSSEC Validation DoS
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0066.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2017-3136 (ISC change 4575) - Fix CVE-2017-3137 (ISC change 4578) - Fix and test caching CNAME before DNAME (ISC change 4558) - Fix CVE-2016-9147 (ISC change 4510) - Fix regression introduced by CVE-2016-8864 (ISC change 4530) - Restore SELinux contexts before named restart - Use /lib or /lib64 only if directory in chroot already exists - Tighten NSS library pattern, escape chroot mount path - Fix (CVE-2016-8864) - Do not change lib permissions in chroot (#1321239) - Support WKS records in chroot (#1297562) - Do not include patch backup in docs (fixes #1325081 patch) - Backported relevant parts of [RT #39567] (#1259923) - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1326283) - Fix multiple realms in nsupdate script like upstream (#1313286) - Fix multiple realm in nsupdate script (#1313286) - Use resolver-query-timeout high enough to recover all forwarders (#1325081) - Fix (CVE-2016-2848) - Fix infinite loop in start_lookup (#1306504) - Fix (CVE-2016-2776)
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 99569
    published 2017-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99569
    title OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)
  • NASL family DNS
    NASL id BIND9_997_RC2.NASL
    description According to its self-reported version number, the remote installation of BIND is potentially affected by multiple vulnerabilities : - A flaw exists within the Domain Name Service due to an error in the code used to follow delegations. A remote attacker, with a maliciously-constructed zone or query, can cause the service to issue unlimited queries, resulting in resource exhaustion. (CVE-2014-8500) - A denial of service vulnerability exists due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. (CVE-2015-1349) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81490
    published 2015-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81490
    title ISC BIND 9.9.7.x < 9.9.7rc2 Multiple Vulnerabilities
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0672.NASL
    description From Red Hat Security Advisory 2015:0672 : Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. A flaw was found in the way BIND handled trust anchor management. A remote attacker could use this flaw to cause the BIND daemon (named) to crash under certain conditions. (CVE-2015-1349) Red Hat would like to thank ISC for reporting this issue. All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 81749
    published 2015-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81749
    title Oracle Linux 6 / 7 : bind (ELSA-2015-0672)
  • NASL family DNS
    NASL id BIND9_9102_RC2.NASL
    description According to its self-reported version number, the remote installation of BIND is potentially affected by multiple vulnerabilities : - A flaw exists within the Domain Name Service due to an error in the code used to follow delegations. A remote attacker, with a maliciously-constructed zone or query, can cause the service to issue unlimited queries, resulting in resource exhaustion. (CVE-2014-8500) - Multiple flaws exist with GeoIP functionality. These flaws allow a remote attacker to cause a denial of service. Note that these issues only affect the 9.10.x branch. (CVE-2014-8680) - A denial of service vulnerability exists due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. (CVE-2015-1349) - An error exists related to handling the 'geoip-directory' option in named.conf when running 'rndc reconfig' or 'rndc reload' that allows connections by unintended clients. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81487
    published 2015-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81487
    title ISC BIND 9.10.2 < 9.10.2rc2 Multiple Vulnerabilities
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2015-0105.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Fix (CVE-2015-5477) - Fix (CVE-2015-4620) - Resolves: 1215687 - DNS resolution failure in high load environment with SERVFAIL and 'out of memory/success' in the log - Fix (CVE-2015-1349) - Enable RPZ-NSIP and RPZ-NSDNAME during compilation (#1176476) - Fix race condition when using isc__begin_beginexclusive (#1175321) - Sanitize SDB API to better handle database errors (#1146893) - Fix CVE-2014-8500 (#1171974) - Fix RRL slip behavior when set to 1 (#1112356) - Fix issue causing bind to hang after reload if using DYNDB (#1142152)
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 85146
    published 2015-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85146
    title OracleVM 3.3 : bind (OVMSA-2015-0105)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SERVER_5_0_3.NASL
    description The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the mod_headers module that allows HTTP trailers to replace HTTP headers late during request processing. A remote attacker can exploit this to inject arbitrary headers. This can also cause some modules to function incorrectly or appear to function incorrectly. (CVE-2013-5704) - A privilege escalation vulnerability exists due to the 'make check' command not properly invoking initdb to specify authentication requirements for a database cluster to be used for tests. A local attacker can exploit this issue to gain temporary server access and elevated privileges. (CVE-2014-0067) - A NULL pointer dereference flaw exists in module mod_cache. A remote attacker, using an empty HTTP Content-Type header, can exploit this vulnerability to crash a caching forward proxy configuration, resulting in a denial of service if using a threaded MPM. (CVE-2014-3581) - A out-of-bounds memory read flaw exists in module mod_proxy_fcgi. An attacker, using a remote FastCGI server to send long response headers, can exploit this vulnerability to cause a denial of service by causing a buffer over-read. (CVE-2014-3583) - A flaw exists in module mod_lua when handling a LuaAuthzProvider used in multiple Require directives with different arguments. An attacker can exploit this vulnerability to bypass intended access restrictions. (CVE-2014-8109) - An information disclosure vulnerability exists due to improper handling of restricted column values in constraint-violation error messages. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2014-8161) - A flaw exists within the Domain Name Service due to an error in the code used to follow delegations. A remote attacker, with a maliciously-constructed zone or query, can cause the service to issue unlimited queries, resulting in resource exhaustion. (CVE-2014-8500) - A flaw exists in the lua_websocket_read() function in the 'mod_lua' module due to incorrect handling of WebSocket PING frames. A remote attacker can exploit this, by sending a crafted WebSocket PING frame after a Lua script has called the wsupgrade() function, to crash a child process, resulting in a denial of service condition. (CVE-2015-0228) - Multiple vulnerabilities exist due to several buffer overflow errors related to the 'to_char' functions. An authenticated, remote attacker can exploit these issues to cause a denial of service or arbitrary code execution. (CVE-2015-0241) - Multiple vulnerabilities exist due to several stack-based buffer overflow errors in various *printf() functions. The overflows are due to improper validation of user-supplied input when formatting a floating point number where the requested precision is greater than approximately 500. An authenticated, remote attacker can exploit these issues to cause a denial of service or arbitrary code execution. (CVE-2015-0242) - Multiple vulnerabilities exist due to an overflow condition in multiple functions in the 'pgcrypto' extension. The overflows are due to improper validation of user-supplied input when tracking memory sizes. An authenticated, remote attacker can exploit these issues to cause a denial of service or arbitrary code execution. (CVE-2015-0243) - A SQL injection vulnerability exists due to improper sanitization of user-supplied input when handling crafted binary data within a command parameter. An authenticated, remote attacker can exploit this issue to inject or manipulate SQL queries, allowing the manipulation or disclosure of arbitrary data. (CVE-2015-0244) - A NULL pointer dereference flaw exists in the read_request_line() function due to a failure to initialize the protocol structure member. A remote attacker can exploit this flaw, on installations that enable the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI, by sending a request that lacks a method, to cause a denial of service condition. (CVE-2015-0253) - A denial of service vulnerability exists due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. (CVE-2015-1349) - A flaw exists in PostgreSQL client disconnect timeout expiration that is triggered when a timeout interrupt is fired partway through the session shutdown sequence. (CVE-2015-3165) - A flaw exists in the printf() functions due to a failure to check for errors. A remote attacker can use this to gain access to sensitive information. (CVE-2015-3166) - The pgcrypto component in PostgreSQL has multiple error messages for decryption with an incorrect key. A remote attacker can use this to recover keys from other systems. (CVE-2015-3167) - A flaw exists in the chunked transfer coding implementation due to a failure to properly parse chunk headers. A remote attacker can exploit this to conduct HTTP request smuggling attacks. (CVE-2015-3183) - A flaw exists in the ap_some_auth_required() function due to a failure to consider that a Require directive may be associated with an authorization setting rather than an authentication setting. A remote attacker can exploit this, if a module that relies on the 2.2 API behavior exists, to bypass intended access restrictions. (CVE-2015-3185) - Multiple unspecified XML flaws exist in the Wiki Server based on Twisted. (CVE-2015-5911)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 86066
    published 2015-09-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86066
    title Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-163.NASL
    description Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-validation auto;' (as enabled in the Debian default configuration) or 'dnssec-lookaside auto;'. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 82147
    published 2015-03-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82147
    title Debian DLA-163-1 : bind9 security update
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201510-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201510-01 (BIND: Denial of Service) A vulnerability has been discovered in BIND’s named utility leading to a Denial of Service condition. Impact : A remote attacker may be able to cause Denial of Service condition via specially constructed zone data. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2015-12-19
    plugin id 86435
    published 2015-10-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86435
    title GLSA-201510-01 : BIND: Denial of Service
  • NASL family F5 Networks Local Security Checks
    NASL id F5_BIGIP_SOL16356.NASL
    description named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
    last seen 2019-02-21
    modified 2019-01-04
    plugin id 82539
    published 2015-04-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82539
    title F5 Networks BIG-IP : BIND vulnerability (SOL16356)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0672.NASL
    description Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. A flaw was found in the way BIND handled trust anchor management. A remote attacker could use this flaw to cause the BIND daemon (named) to crash under certain conditions. (CVE-2015-1349) Red Hat would like to thank ISC for reporting this issue. All bind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the BIND daemon (named) will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81759
    published 2015-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81759
    title CentOS 6 / 7 : bind (CESA-2015:0672)
redhat via4
advisories
bugzilla
id 1193820
title CVE-2015-1349 bind: issue in trust anchor management can cause named to crash
oval
OR
  • AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment bind is earlier than 32:9.8.2-0.30.rc1.el6_6.2
          oval oval:com.redhat.rhsa:tst:20150672005
        • comment bind is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975006
      • AND
        • comment bind-chroot is earlier than 32:9.8.2-0.30.rc1.el6_6.2
          oval oval:com.redhat.rhsa:tst:20150672011
        • comment bind-chroot is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975012
      • AND
        • comment bind-devel is earlier than 32:9.8.2-0.30.rc1.el6_6.2
          oval oval:com.redhat.rhsa:tst:20150672009
        • comment bind-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975010
      • AND
        • comment bind-libs is earlier than 32:9.8.2-0.30.rc1.el6_6.2
          oval oval:com.redhat.rhsa:tst:20150672007
        • comment bind-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975016
      • AND
        • comment bind-sdb is earlier than 32:9.8.2-0.30.rc1.el6_6.2
          oval oval:com.redhat.rhsa:tst:20150672013
        • comment bind-sdb is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975014
      • AND
        • comment bind-utils is earlier than 32:9.8.2-0.30.rc1.el6_6.2
          oval oval:com.redhat.rhsa:tst:20150672015
        • comment bind-utils is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975008
  • AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    • OR
      • AND
        • comment bind is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672021
        • comment bind is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975006
      • AND
        • comment bind-chroot is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672033
        • comment bind-chroot is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975012
      • AND
        • comment bind-devel is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672030
        • comment bind-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975010
      • AND
        • comment bind-libs is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672023
        • comment bind-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975016
      • AND
        • comment bind-libs-lite is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672026
        • comment bind-libs-lite is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141984041
      • AND
        • comment bind-license is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672031
        • comment bind-license is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141984029
      • AND
        • comment bind-lite-devel is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672028
        • comment bind-lite-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141984039
      • AND
        • comment bind-sdb is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672034
        • comment bind-sdb is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975014
      • AND
        • comment bind-sdb-chroot is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672024
        • comment bind-sdb-chroot is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141984035
      • AND
        • comment bind-utils is earlier than 32:9.9.4-18.el7_1.1
          oval oval:com.redhat.rhsa:tst:20150672022
        • comment bind-utils is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100975008
rhsa
id RHSA-2015:0672
released 2015-03-10
severity Moderate
title RHSA-2015:0672: bind security update (Moderate)
rpms
  • bind-32:9.8.2-0.30.rc1.el6_6.2
  • bind-chroot-32:9.8.2-0.30.rc1.el6_6.2
  • bind-devel-32:9.8.2-0.30.rc1.el6_6.2
  • bind-libs-32:9.8.2-0.30.rc1.el6_6.2
  • bind-sdb-32:9.8.2-0.30.rc1.el6_6.2
  • bind-utils-32:9.8.2-0.30.rc1.el6_6.2
  • bind-32:9.9.4-18.el7_1.1
  • bind-chroot-32:9.9.4-18.el7_1.1
  • bind-devel-32:9.9.4-18.el7_1.1
  • bind-libs-32:9.9.4-18.el7_1.1
  • bind-libs-lite-32:9.9.4-18.el7_1.1
  • bind-license-32:9.9.4-18.el7_1.1
  • bind-lite-devel-32:9.9.4-18.el7_1.1
  • bind-sdb-32:9.9.4-18.el7_1.1
  • bind-sdb-chroot-32:9.9.4-18.el7_1.1
  • bind-utils-32:9.9.4-18.el7_1.1
refmap via4
apple APPLE-SA-2015-09-16-4
confirm
fedora
  • FEDORA-2015-2543
  • FEDORA-2015-2548
gentoo GLSA-201510-01
hp
  • HPSBUX03379
  • SSRT101976
mandriva
  • MDVSA-2015:054
  • MDVSA-2015:165
suse
  • SUSE-SU-2015:1205
  • openSUSE-SU-2015:1250
  • openSUSE-SU-2015:1326
ubuntu USN-2503-1
Last major update 27-12-2016 - 21:59
Published 18-02-2015 - 22:01
Last modified 30-10-2018 - 12:27
Back to Top