ISC BIND Cache-Poisoning Vulnerability (CVE-2025-40776, Birthday Attack) - Linux

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:isc:bind";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.154963");
  script_version("2025-07-18T05:44:10+0000");
  script_tag(name:"last_modification", value:"2025-07-18 05:44:10 +0000 (Fri, 18 Jul 2025)");
  script_tag(name:"creation_date", value:"2025-07-17 02:54:51 +0000 (Thu, 17 Jul 2025)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-07-16 14:15:25 +0000 (Wed, 16 Jul 2025)");

  script_cve_id("CVE-2025-40776");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("ISC BIND Cache-Poisoning Vulnerability (CVE-2025-40776, Birthday Attack) - Linux");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_isc_bind_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("isc/bind/detected", "Host/runs_unixoide");

  script_tag(name:"summary", value:"ISC BIND is prone to a cache-poisoning vulnerability (Birthday
  Attack against Resolvers supporting ECS).");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"A named caching resolver that is configured to send ECS (EDNS
  Client Subnet) options may be vulnerable to a cache-poisoning attack.");

  script_tag(name:"impact", value:"A resolver configured to send ECS options to authoritative
  servers can be compelled to make queries that slightly increase the odds of guessing the source
  port and other details necessary to bypass the original birthday cache poisoning attack
  mitigations. As a result of this weakness, a resolver with ECS enabled is more vulnerable to
  successful cache poisoning via spoofed query responses than one that does not implement this
  feature.");

  script_tag(name:"affected", value:"ISC BIND version 9.0.0 through 9.20.10, 9.11.3-S1 through
  9.16.50-S1, 9.18.11-S1 through 9.18.37-S1 and 9.20.9-S1 through 9.20.10-S1.");

  script_tag(name:"solution", value:"Update to version 9.20.11, 9.18.38-S1, 9.20.11-S1 or later.");

  script_xref(name:"URL", value:"https://kb.isc.org/docs/cve-2025-40776");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_full(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
proto = infos["proto"];
location = infos["location"];

if (version =~ "^9\.[0-9]+\.[0-9]+s[0-9]") {
  if (version_in_range(version: version, test_version: "9.11.3s1", test_version2: "9.16.50s1") ||
      version_in_range(version: version, test_version: "9.18.11s1", test_version2: "9.18.37s1")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.18.38-S1", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }

  if (version_in_range(version: version, test_version: "9.20.9s1", test_version2: "9.20.10s1")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.20.11-S1", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }
} else {
  if (version_in_range(version: version, test_version: "9.0.0", test_version2: "9.20.10")) {
    report = report_fixed_ver(installed_version: version, fixed_version: "9.20.11", install_path: location);
    security_message(port: port, data: report, proto: proto);
    exit(0);
  }
}

exit(99);