ISC BIND 9 < 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1r3 Multiple Vunlerabilities

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(99478);
  script_version("1.7");
  script_cvs_date("Date: 2019/11/13");

  script_cve_id("CVE-2017-3136", "CVE-2017-3137", "CVE-2017-3138");
  script_bugtraq_id(97651, 97653, 97657);

  script_name(english:"ISC BIND 9 < 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1r3 Multiple Vunlerabilities");
  script_summary(english:"Checks the version of BIND.");

  script_set_attribute(attribute:"synopsis", value:
"The remote name server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of ISC BIND 9
running on the remote name server is 9.9.x prior to 9.9.9-P8 or
9.9.9-S10, 9.10.x prior to 9.10.4-P8, or 9.11.x prior to 9.11.0-P5. It
is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in DNS64 when
    handling certain queries for synthesized records. An
    unauthenticated, remote attacker can exploit this, via a
    specially crafted query, to cause an assertion failure,
    resulting in DNS64 terminating. Note that issue applies
    if the server is configured to use DNS64 and if the
    option 'break-dnssec yes;' is in use. (CVE-2017-3136)

  - A denial of service vulnerability exists when handling
    specially crafted responses containing CNAME or DNAME
    resource records that are ordered in specific ways. An
    unauthenticated, remote attacker can exploit this, via
    responses sent in an unusual order, to cause an
    assertion failure, resulting in the resolver
    terminating. (CVE-2017-3137)

  - A denial of service vulnerability exists when handling a
    NULL command string sent to the named control channel.
    An authenticated, remote attacker can exploit this to
    cause an REQUIRE assertion failure, resulting in the
    named daemon exiting. Note that the BIND control channel
    is not configured by default. (CVE-2017-3138)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/article/AA-01465");
  script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/article/AA-01466");
  script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/article/AA-01471");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ISC BIND version 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 /
9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1rc3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-3137");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/19");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:isc:bind");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"DNS");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("bind_version.nasl");
  script_require_keys("bind/version", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

ver = get_kb_item_or_exit("bind/version");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

if (
  # 9.9.0 - 9.9.8
  ver =~ "^9\.9\.[0-8]($|[^0-9])" ||
  # 9.9.9 <= 9.9.9-P7/9.9.9-S9
  ver =~ "^9\.9\.9((([ab]|beta|rc)[0-9]*)|(-P[0-7])|(-S[0-9]))?$" ||

  # 9.10.0 - 9.10.3
  ver =~ "^9\.10\.[0-3]($|[^0-9])" ||
  # 9.10.4 <= 9.10.4-P7
  ver =~ "^9\.10\.4((([ab]|beta|rc)[0-9]*)|(-P[0-7]))?$" ||

  # 9.11.0.x <= 9.11.0-P4
  ver =~ "^9\.11\.0((([ab]|beta|rc)[0-9]*)|(-P[0-4]))?$" ||

  # beta and RC versions
  # 9.9.10b1 - 9.9.10rc2
  ver =~ "^9\.9\.10(b|beta)([0-9]*)?$" ||
  ver =~ "^9\.9\.10rc[0-2]?$" ||

  # 9.10.5b1 - 9.10.5rc2
  ver =~ "^9\.10\.5(b|beta)([0-9]*)?$" ||
  ver =~ "^9\.10\.5rc[0-2]?$" ||

  # 9.11.1b1 - 9.11.1rc2
  ver =~ "^9\.11\.1((b|beta)[0-9])?$" ||
  ver =~ "^9\.11\.1rc[0-2]?$"
)
{
  items = make_array(
    "Installed version", ver,
    "Fixed version", "9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1rc3"
  );
  order = make_list("Installed version", "Fixed version");
  security_report_v4(
    severity:SECURITY_WARNING,
    port:53,
    proto:"udp",
    extra:report_items_str(
      report_items:items,
      ordered_fields:order
    )
  );
}
else audit(AUDIT_LISTEN_NOT_VULN, "BIND", 53, ver, "UDP");