PT-2017-15682 · Isc+2 · Bind+2

Published 2017-06-14 · Updated 2019-10-09 · CVE-2017-3140

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIND versions 9.9.10 through 9.9.10-S1 BIND versions 9.10.5 through 9.10.5-S1 BIND versions 9.11.0 through 9.11.1

Description The issue arises when named is configured to use Response Policy Zones (RPZ) and an error occurs while processing certain rule types, leading to an endless loop in BIND when handling a query. This can be exploited by attackers to cause a denial of service via a specially crafted query.

Recommendations For BIND versions 9.9.10 through 9.9.10-S1, update to a version that includes the fix for this issue. For BIND versions 9.10.5 through 9.10.5-S1, update to a version that includes the fix for this issue. For BIND versions 9.11.0 through 9.11.1, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the use of Response Policy Zones (RPZ) until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2017-1966

CVE-2017-3140

Affected Products

Alt Linux

Bind

Bind Server

References · 24

• https://cve.org/CVERecord?id=CVE-2017-3140 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-3140 · Security Note
• https://kb.isc.org/docs/aa-01495 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3142 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3140 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3140 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3140 · Vendor Advisory
• https://security.gentoo.org/glsa/201708-01 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3141 · Security Note
• https://bdu.fstec.ru/vul/2018-00105 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2017-3140 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1966 · Vendor Advisory
• http://securitytracker.com/id/1038692 · Note