F5 Networks BIG-IP : BIND vulnerability (K000162286)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from F5 Networks BIG-IP Solution K000162286.
#
# @NOAGENT@
##

include('compat.inc');

if (description)
{
  script_id(330803);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id("CVE-2026-1519");

  script_name(english:"F5 Networks BIG-IP : BIND vulnerability (K000162286)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of F5 Networks BIG-IP installed on the remote host is prior to 21.1.0. It is, therefore, affected by a
vulnerability as referenced in the K000162286 advisory.

    If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver
    may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are
    circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-
    does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through
    9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through
    9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.(CVE-2026-1519)BIG-IP LTM with
    no DNS provisionedThe BIG-IP system contains the vulnerable version of BIND, and BIND is enabled by
    default. However, when LTM is provisioned and DNS is not provisioned, BIND is present but is not used as a
    resolver performing Domain Name System Security Extensions (DNSSEC) validation. Because the attack
    requires DNSSEC validation to be in the processing path, LTM with no DNS module provisioned is not
    vulnerable.BIG-IP with DNS provisionedBIG-IP DNS is vulnerable under the following conditions:BIND is
    acting as a recursive resolver. By default, BIND on the BIG-IP system hasrecursion no;configured, which
    means it is not a recursive resolver. If you have manually enabled recursion by addingrecursion yes;to
    thenamed.conffile, BIND can perform DNSSEC validation on behalf of clients and is therefore vulnerable.
    You can check this by runninggrep recursion /var/named/config/named.conf. If the result showsrecursion
    no;, this configuration is not vulnerable.DNS Cache is configured as a Validating Resolver. If a DNS Cache
    instance has been configured with the type set to Validating Resolver, it performs DNSSEC validation as
    its core function regardless of what BIND's recursion setting is. This means a system can be vulnerable
    through this path even if BIND recursion is disabled. You can check this by running thetmsh list ltm dns
    cache validating-resolvercommand. If any output is returned, a Validating Resolver cache exists and the
    system is vulnerable when using this configuration.A plain Resolver cache type (not Validating Resolver)
    performs recursive resolution but does not perform DNSSEC validation, so it is not directly vulnerable to
    this specific CVE.Even if BIND recursion is disabled, if the system relies on BIND's DNSSEC validation
    logic and can accept queries from sources that could reach attacker-controlled domains, there is still
    potential exposure. In practice, the Validating Resolver DNS Cache path is the most likely way this
    applies when BIND recursion is off.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://my.f5.com/manage/s/article/K000162286");
  script_set_attribute(attribute:"solution", value:
"Upgrade to one of the non-vulnerable versions listed in the F5 Solution K000162286.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-1519");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_domain_name_system");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_global_traffic_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"F5 Networks Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("f5_bigip_detect.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/BIG-IP/hotfix", "Host/BIG-IP/modules", "Host/BIG-IP/version", "Settings/ParanoidReport");

  exit(0);
}


include('f5_func.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var version = get_kb_item('Host/BIG-IP/version');
if ( ! version ) audit(AUDIT_OS_NOT, 'F5 Networks BIG-IP');
if ( isnull(get_kb_item('Host/BIG-IP/hotfix')) ) audit(AUDIT_KB_MISSING, 'Host/BIG-IP/hotfix');
if ( ! get_kb_item('Host/BIG-IP/modules') ) audit(AUDIT_KB_MISSING, 'Host/BIG-IP/modules');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var sol = 'K000162286';
var vmatrix = {
  'DNS': {
    'affected': [
      '21.0.0','17.5.0-17.5.1','17.1.0-17.1.3'
    ],
    'unaffected': [
      '21.1.0'
    ],
  }
};

if (bigip_is_affected(vmatrix:vmatrix, sol:sol))
{
  var extra = NULL;
  if (report_verbosity > 0) extra = bigip_report_get();
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : extra
  );
}
else
{
  var tested = bigip_get_tested_modules();
  var audit_extra = 'For BIG-IP module(s) ' + tested + ',';
  if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);
  else audit(AUDIT_HOST_NOT, 'running the affected module DNS');
}