Test ID:	1.3.6.1.4.1.25623.1.1.13.2022.080.01
Category:	Slackware Local Security Checks
Title:	Slackware: Security Advisory (SSA:2022-080-01)
Summary:	The remote host is missing an update for the 'bind' package(s) announced via the SSA:2022-080-01 advisory.
Description:	Summary: The remote host is missing an update for the 'bind' package(s) announced via the SSA:2022-080-01 advisory. Vulnerability Insight: New bind packages are available for Slackware 15.0, since the previous patch mistakenly moved to a newer BIND branch. These packages do not fix any security issues that weren't already fixed in the bind-9.18.1 packages, which have been moved into /testing, but the BIND 9.16 LTS version is the correct one for Slackware 15.0. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/bind-9.16.27-i586-1_slack15.0.txz: Upgraded. Sorry folks, I had not meant to bump BIND to the newer branch. I've moved the other packages into /testing. Thanks to Nobby6 for pointing this out. This update fixes bugs and the following security issues: A synchronous call to closehandle_cb() caused isc__nm_process_sock_buffer() to be called recursively, which in turn left TCP connections hanging in the CLOSE_WAIT state blocking indefinitely when out-of-order processing was disabled. The rules for acceptance of records into the cache have been tightened to prevent the possibility of poisoning if forwarders send records outside the configured bailiwick. For more information, see: [links moved to references] (* Security fix *) testing/packages/bind-9.18.1-i586-1_slack15.0.txz: Moved. +--------------------------+ Affected Software/OS: 'bind' package(s) on Slackware 15.0. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-25220 https://kb.isc.org/v1/docs/cve-2021-25220 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/API7U5E7SX7BAAVFNW366FFJGD6NZZKV/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DE3UAVCPUMAKG27ZL5YXSP2C3RIOW3JZ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5VX3I2U3ICOIEI5Y7OYA6CHOLFMNH3YQ/ https://security.gentoo.org/glsa/202210-25 https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US Common Vulnerability Exposure (CVE) ID: CVE-2022-0396 https://kb.isc.org/v1/docs/cve-2022-0396
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.