|Category:||Huawei EulerOS Local Security Checks|
|Title:||Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2020-2444)|
|Summary:||The remote host is missing an update for the Huawei EulerOS; 'bind' package(s) announced via the EulerOS-SA-2020-2444 advisory.|
The remote host is missing an update for the Huawei EulerOS
'bind' package(s) announced via the EulerOS-SA-2020-2444 advisory.
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.(CVE-2020-8617)
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.(CVE-2020-8616)
'bind' package(s) on Huawei EulerOS Virtualization 188.8.131.52.
Please install the updated package(s).
Common Vulnerability Exposure (CVE) ID: CVE-2020-8616|
Debian Security Information: DSA-4689 (Google Search)
SuSE Security Announcement: openSUSE-SU-2020:1699 (Google Search)
SuSE Security Announcement: openSUSE-SU-2020:1701 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2020-8617
|Copyright||Copyright (C) 2020 Greenbone Networks GmbH|
|This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.