Security update for 'bind' package on Slackware 14.0, 14.1, 14.2, and curren
Reporter | Title | Published | Views | Family All 199 |
---|---|---|---|---|
![]() | RHEL 7 : bind (RHSA-2020:5011) | 13 Nov 202000:00 | – | nessus |
![]() | RHEL 7 : bind (RHSA-2020:5203) | 24 Nov 202000:00 | – | nessus |
![]() | Fedora 31 : 32:bind / bind-dyndb-ldap / dnsperf (2020-14c194e5af) | 31 Aug 202000:00 | – | nessus |
![]() | EulerOS Virtualization 2.9.1 : bind (EulerOS-SA-2021-1589) | 10 Mar 202100:00 | – | nessus |
![]() | Slackware 14.0 / 14.1 / 14.2 / current : bind (SSA:2020-234-01) | 24 Aug 202000:00 | – | nessus |
![]() | EulerOS Virtualization 2.9.0 : bind (EulerOS-SA-2021-1647) | 11 Mar 202100:00 | – | nessus |
![]() | Oracle Linux 7 : bind (ELSA-2020-5011) | 12 Nov 202000:00 | – | nessus |
![]() | CentOS 7 : bind (RHSA-2020:5011) | 18 Nov 202000:00 | – | nessus |
![]() | NewStart CGSL CORE 5.05 / MAIN 5.05 : bind Multiple Vulnerabilities (NS-SA-2021-0153) | 27 Oct 202100:00 | – | nessus |
![]() | Amazon Linux 2 : bind (ALAS-2020-1564) | 9 Dec 202000:00 | – | nessus |
# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.1.13.2020.234.01");
script_cve_id("CVE-2020-8622", "CVE-2020-8623", "CVE-2020-8624");
script_tag(name:"creation_date", value:"2022-04-21 12:12:27 +0000 (Thu, 21 Apr 2022)");
script_version("2025-01-14T05:37:03+0000");
script_tag(name:"last_modification", value:"2025-01-14 05:37:03 +0000 (Tue, 14 Jan 2025)");
script_tag(name:"cvss_base", value:"4.3");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:N/A:P");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2020-08-26 17:55:39 +0000 (Wed, 26 Aug 2020)");
script_name("Slackware: Security Advisory (SSA:2020-234-01)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2022 Greenbone AG");
script_family("Slackware Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/slackware_linux", "ssh/login/slackpack", re:"ssh/login/release=SLK(14\.0|14\.1|14\.2|current)");
script_xref(name:"Advisory-ID", value:"SSA:2020-234-01");
script_xref(name:"URL", value:"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2020&m=slackware-security.485810");
script_xref(name:"URL", value:"https://kb.isc.org/docs/cve-2020-8622");
script_xref(name:"URL", value:"https://kb.isc.org/docs/cve-2020-8623");
script_xref(name:"URL", value:"https://kb.isc.org/docs/cve-2020-8624");
script_tag(name:"summary", value:"The remote host is missing an update for the 'bind' package(s) announced via the SSA:2020-234-01 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to
fix security issues.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/bind-9.11.22-i586-1_slack14.2.txz: Upgraded.
This update fixes three security issues:
'update-policy' rules of type 'subdomain' were incorrectly treated as
'zonesub' rules, which allowed keys used in 'subdomain' rules to update
names outside of the specified subdomains. The problem was fixed by making
sure 'subdomain' rules are again processed as described in the ARM.
When BIND 9 was compiled with native PKCS#11 support, it was possible to
trigger an assertion failure in code determining the number of bits in the
PKCS#11 RSA public key with a specially crafted packet.
It was possible to trigger an assertion failure when verifying the response
to a TSIG-signed request.
For more information, see:
[links moved to references]
(* Security fix *)
+--------------------------+");
script_tag(name:"affected", value:"'bind' package(s) on Slackware 14.0, Slackware 14.1, Slackware 14.2, Slackware current.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-slack.inc");
release = slk_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "SLK14.0") {
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.11.22-i486-1_slack14.0", rls:"SLK14.0"))) {
report += res;
}
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.11.22-x86_64-1_slack14.0", rls:"SLK14.0"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLK14.1") {
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.11.22-i486-1_slack14.1", rls:"SLK14.1"))) {
report += res;
}
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.11.22-x86_64-1_slack14.1", rls:"SLK14.1"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLK14.2") {
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.11.22-i586-1_slack14.2", rls:"SLK14.2"))) {
report += res;
}
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.11.22-x86_64-1_slack14.2", rls:"SLK14.2"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLKcurrent") {
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.16.6-i586-1", rls:"SLKcurrent"))) {
report += res;
}
if(!isnull(res = isslkpkgvuln(pkg:"bind", ver:"9.16.6-x86_64-1", rls:"SLKcurrent"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo