PT-2017-11743 · Cz.Nic+1 · Knot Dns+1

Published 2017-07-08 · Updated 2023-01-20 · CVE-2017-11104

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Knot DNS versions prior to 2.4.5 Knot DNS versions 2.5.x prior to 2.5.2

Description The issue is related to a flaw in the TSIG protocol implementation. This flaw allows an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set. The bypass is possible due to an improper TSIG validity period check.

Recommendations For Knot DNS versions prior to 2.4.5, update to version 2.4.5 or later. For Knot DNS versions 2.5.x prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-11104

DSA-3910-1

OPENSUSE-SU-2018_1395-1

OPENSUSE-SU-2020:1085-1

OPENSUSE-SU-2020:1086-1

OPENSUSE-SU-2020:1112-1

OPENSUSE-SU-2020:1232-1

OPENSUSE-SU-2020_1085-1

OPENSUSE-SU-2020_1086-1

Affected Products

Knot Dns

Suse

References · 27

• 🔥 http://synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdf · Exploit
• https://osv.dev/vulnerability/DSA-3910-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00078.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11104 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1086-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00049.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11104 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:1085-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1232-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11104 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00076.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11104 · Vendor Advisory
• https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2017-11104 · Vendor Advisory
• http://debian.org/security/2017/dsa-3910 · Vendor Advisory