PT-2017-15681 · Isc+4 · Bind+4

Mike Lalumiere · Published 2017-04-12 · Updated 2019-10-09 · CVE-2017-3138

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIND 9.9.9 through 9.9.9-P7 BIND 9.9.10b1 through 9.9.10rc2 BIND 9.10.4 through 9.10.4-P7 BIND 9.10.5b1 through 9.10.5rc2 BIND 9.11.0 through 9.11.0-P4 BIND 9.11.1b1 through 9.11.1rc2 BIND 9.9.9-S1 through 9.9.9-S9

Description The issue arises from a regression in a recent feature change, allowing attackers to cause a denial of service by sending a null command string over a control channel to the named server process. This can result in the server exiting with a REQUIRE assertion failure.

Recommendations For BIND 9.9.9 through 9.9.9-P7, update to a version outside of this range to resolve the issue. For BIND 9.9.10b1 through 9.9.10rc2, update to a version outside of this range to resolve the issue. For BIND 9.10.4 through 9.10.4-P7, update to a version outside of this range to resolve the issue. For BIND 9.10.5b1 through 9.10.5rc2, update to a version outside of this range to resolve the issue. For BIND 9.11.0 through 9.11.0-P4, update to a version outside of this range to resolve the issue. For BIND 9.11.1b1 through 9.11.1rc2, update to a version outside of this range to resolve the issue. For BIND 9.9.9-S1 through 9.9.9-S9, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the control channel to minimize the risk of exploitation.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALT-PU-2017-1464

CVE-2017-3138

DLA-957-1

DSA-3854-1

MGASA-2017-0478

OPENSUSE-SU-2017_1063-1

SUSE-SU-2017:0998-1

SUSE-SU-2017:0999-1

SUSE-SU-2017:1000-1

USN-3259-1

Affected Products

Alt Linux

Bind

Bind Server

Suse

Ubuntu

References · 78

• https://osv.dev/vulnerability/CVE-2017-3138 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3259-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3138 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3136 · Security Note
• https://kb.isc.org/docs/aa-01471 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3259-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1000-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3138 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-3138 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8864 · Security Note
• https://security-tracker.debian.org/tracker/source-package/bind9 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3854-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-3138 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0478 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6170 · Security Note