The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5854 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5854-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     January 29, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2024-11187 CVE-2024-12705

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in denial of service.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:9.18.33-1~deb12u2.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2751 advisory.

    It is possible to construct a zone such that some queries to it will generate responses containing     numerous records in the Additional section. An attacker sending many such queries can cause either the     authoritative server itself or an independent resolver to use disproportionate resources processing the     queries. Zones will usually need to have been deliberately crafted to attack this exposure.This issue     affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0     through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and     9.18.11-S1 through 9.18.32-S1. (CVE-2024-11187)

    Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with     crafted valid or invalid HTTP/2 traffic.This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0     through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. (CVE-2024-12705)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1670 advisory.

    BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND     includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for     applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating     properly.

    Security Fix(es):

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

    * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load     (CVE-2024-12705)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_1670 advisory.

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)

    * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load     (CVE-2024-12705)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9706:01 advisory.

    * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)
      * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load     (CVE-2024-12705)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-3551f3ba1b advisory.

    # Update to 9.16.33 (#2342784)     ##Security Fixes:

    -    DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
    -    Limit additional section processing for large RDATA sets. (CVE-2024-11187)

    # New Features:

    -    Add a new option to configure the maximum number of outgoing queries per client request.

    # Bug Fixes:

    -    Fix nsupdate hang when processing a large update.
    -   Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
    -   Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
    -   Fix improper handling of unknown directives in resolv.conf.

    [Upstream Release Notes](https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-     bind-9-18-33)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12705 advisory.

  - Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with     crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0     through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. (CVE-2024-12705)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.18.33 / 9.20.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-029-01 advisory.

    New bind packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-838 advisory.

    It is possible to construct a zone such that some queries to it will generate responses containing     numerous records in the Additional section. An attacker sending many such queries can cause either the     authoritative server itself or an independent resolver to use disproportionate resources processing the     queries. Zones will usually need to have been deliberately crafted to attack this exposure.This issue     affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0     through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and     9.18.11-S1 through 9.18.32-S1. (CVE-2024-11187)

    Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with     crafted valid or invalid HTTP/2 traffic.This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0     through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. (CVE-2024-12705)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with     crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0     through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. (CVE-2024-12705)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
214787	Debian dsa-5854 : bind9 - security update	Nessus	Debian Local Security Checks	2025/1/29	2025/5/22	high
214980	Amazon Linux 2 : bind (ALAS-2025-2751)	Nessus	Amazon Linux Local Security Checks	2025/2/4	2025/5/22	high
216489	RHEL 9 : bind9.18 (RHSA-2025:1670)	Nessus	Red Hat Local Security Checks	2025/2/19	2025/6/5	high
235140	Photon OS 5.0: Bindutils PHSA-2025-5.0-0511	Nessus	PhotonOS Local Security Checks	2025/5/5	2026/10/14	high
357757	Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_1670)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
282878	MiracleLinux 9 : bind9.18-9.18.29-1.el9_5.1 (AXSA:2025-9706:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
216157	Fedora 41 : bind / bind-dyndb-ldap (2025-3551f3ba1b)	Nessus	Fedora Local Security Checks	2025/2/12	2025/5/22	high
295555	Azure Linux 3.0 Security Update: bind (CVE-2024-12705)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	high
214786	Slackware Linux 15.0 / current bind Multiple Vulnerabilities (SSA:2025-029-01)	Nessus	Slackware Local Security Checks	2025/1/29	2025/5/22	high
215038	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2025-838)	Nessus	Amazon Linux Local Security Checks	2025/2/5	2025/5/22	high
227699	Linux Distros Unpatched Vulnerability : CVE-2024-12705	Nessus	Misc.	2025/3/5	2026/7/25	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

high