csaf_suse - suse-su-2017:1738-1

Vulnerability from csaf_suse

Published

2017-06-29 20:20

Modified

2017-06-29 20:20

Summary

Security update for bind

Notes

Title of the patch

Security update for bind

Description of the patch

This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143]

Patchnames

SUSE-SLE-SAP-12-2017-1078,SUSE-SLE-SERVER-12-2017-1078

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for bind",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for bind fixes the following issues:\n\n- An attacker with the ability to send and receive messages to an authoritative\n  DNS server was able to circumvent TSIG authentication of AXFR requests. A\n  server that relied solely on TSIG keys for protection could be manipulated\n  into (1) providing an AXFR of a zone to an unauthorized recipient and (2)\n  accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142]\n\n- An attacker who with the ability to send and receive messages to an\n  authoritative DNS server and who had knowledge of a valid TSIG key name for\n  the zone and service being targeted was able to manipulate BIND into\n  accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143]\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-SLE-SAP-12-2017-1078,SUSE-SLE-SERVER-12-2017-1078",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_1738-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2017:1738-1",
            url: "https://www.suse.com/support/update/announcement/2017/suse-su-20171738-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2017:1738-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2017-June/002999.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1046554",
            url: "https://bugzilla.suse.com/1046554",
         },
         {
            category: "self",
            summary: "SUSE Bug 1046555",
            url: "https://bugzilla.suse.com/1046555",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-3142 page",
            url: "https://www.suse.com/security/cve/CVE-2017-3142/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-3143 page",
            url: "https://www.suse.com/security/cve/CVE-2017-3143/",
         },
      ],
      title: "Security update for bind",
      tracking: {
         current_release_date: "2017-06-29T20:20:16Z",
         generator: {
            date: "2017-06-29T20:20:16Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2017:1738-1",
         initial_release_date: "2017-06-29T20:20:16Z",
         revision_history: [
            {
               date: "2017-06-29T20:20:16Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-doc-9.9.9P1-28.37.1.noarch",
                        product: {
                           name: "bind-doc-9.9.9P1-28.37.1.noarch",
                           product_id: "bind-doc-9.9.9P1-28.37.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.9.9P1-28.37.1.ppc64le",
                        product: {
                           name: "bind-9.9.9P1-28.37.1.ppc64le",
                           product_id: "bind-9.9.9P1-28.37.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                        product: {
                           name: "bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                           product_id: "bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-devel-9.9.9P1-28.37.1.ppc64le",
                        product: {
                           name: "bind-devel-9.9.9P1-28.37.1.ppc64le",
                           product_id: "bind-devel-9.9.9P1-28.37.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-libs-9.9.9P1-28.37.1.ppc64le",
                        product: {
                           name: "bind-libs-9.9.9P1-28.37.1.ppc64le",
                           product_id: "bind-libs-9.9.9P1-28.37.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.9.9P1-28.37.1.ppc64le",
                        product: {
                           name: "bind-utils-9.9.9P1-28.37.1.ppc64le",
                           product_id: "bind-utils-9.9.9P1-28.37.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.9.9P1-28.37.1.s390x",
                        product: {
                           name: "bind-9.9.9P1-28.37.1.s390x",
                           product_id: "bind-9.9.9P1-28.37.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-chrootenv-9.9.9P1-28.37.1.s390x",
                        product: {
                           name: "bind-chrootenv-9.9.9P1-28.37.1.s390x",
                           product_id: "bind-chrootenv-9.9.9P1-28.37.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-devel-9.9.9P1-28.37.1.s390x",
                        product: {
                           name: "bind-devel-9.9.9P1-28.37.1.s390x",
                           product_id: "bind-devel-9.9.9P1-28.37.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-libs-9.9.9P1-28.37.1.s390x",
                        product: {
                           name: "bind-libs-9.9.9P1-28.37.1.s390x",
                           product_id: "bind-libs-9.9.9P1-28.37.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                        product: {
                           name: "bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                           product_id: "bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.9.9P1-28.37.1.s390x",
                        product: {
                           name: "bind-utils-9.9.9P1-28.37.1.s390x",
                           product_id: "bind-utils-9.9.9P1-28.37.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.9.9P1-28.37.1.x86_64",
                        product: {
                           name: "bind-9.9.9P1-28.37.1.x86_64",
                           product_id: "bind-9.9.9P1-28.37.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                        product: {
                           name: "bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                           product_id: "bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-devel-9.9.9P1-28.37.1.x86_64",
                        product: {
                           name: "bind-devel-9.9.9P1-28.37.1.x86_64",
                           product_id: "bind-devel-9.9.9P1-28.37.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-libs-9.9.9P1-28.37.1.x86_64",
                        product: {
                           name: "bind-libs-9.9.9P1-28.37.1.x86_64",
                           product_id: "bind-libs-9.9.9P1-28.37.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                        product: {
                           name: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                           product_id: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.9.9P1-28.37.1.x86_64",
                        product: {
                           name: "bind-utils-9.9.9P1-28.37.1.x86_64",
                           product_id: "bind-utils-9.9.9P1-28.37.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise Server 12-LTSS",
                           product_id: "SUSE Linux Enterprise Server 12-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-ltss:12",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-chrootenv-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-chrootenv-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-devel-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-devel-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-doc-9.9.9P1-28.37.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
            },
            product_reference: "bind-doc-9.9.9P1-28.37.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-libs-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-utils-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.9.9P1-28.37.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
            },
            product_reference: "bind-9.9.9P1-28.37.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.9.9P1-28.37.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
            },
            product_reference: "bind-9.9.9P1-28.37.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-chrootenv-9.9.9P1-28.37.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
            },
            product_reference: "bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-chrootenv-9.9.9P1-28.37.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
            },
            product_reference: "bind-chrootenv-9.9.9P1-28.37.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-chrootenv-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-chrootenv-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-devel-9.9.9P1-28.37.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
            },
            product_reference: "bind-devel-9.9.9P1-28.37.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-devel-9.9.9P1-28.37.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
            },
            product_reference: "bind-devel-9.9.9P1-28.37.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-devel-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-devel-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-doc-9.9.9P1-28.37.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
            },
            product_reference: "bind-doc-9.9.9P1-28.37.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-9.9.9P1-28.37.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
            },
            product_reference: "bind-libs-9.9.9P1-28.37.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-9.9.9P1-28.37.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
            },
            product_reference: "bind-libs-9.9.9P1-28.37.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-libs-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-32bit-9.9.9P1-28.37.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
            },
            product_reference: "bind-libs-32bit-9.9.9P1-28.37.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.9.9P1-28.37.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
            },
            product_reference: "bind-utils-9.9.9P1-28.37.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.9.9P1-28.37.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
            },
            product_reference: "bind-utils-9.9.9P1-28.37.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.9.9P1-28.37.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
            },
            product_reference: "bind-utils-9.9.9P1-28.37.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2017-3142",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-3142",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-3142",
               url: "https://www.suse.com/security/cve/CVE-2017-3142",
            },
            {
               category: "external",
               summary: "SUSE Bug 1024130 for CVE-2017-3142",
               url: "https://bugzilla.suse.com/1024130",
            },
            {
               category: "external",
               summary: "SUSE Bug 1046554 for CVE-2017-3142",
               url: "https://bugzilla.suse.com/1046554",
            },
            {
               category: "external",
               summary: "SUSE Bug 1046555 for CVE-2017-3142",
               url: "https://bugzilla.suse.com/1046555",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-06-29T20:20:16Z",
               details: "important",
            },
         ],
         title: "CVE-2017-3142",
      },
      {
         cve: "CVE-2017-3143",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-3143",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-3143",
               url: "https://www.suse.com/security/cve/CVE-2017-3143",
            },
            {
               category: "external",
               summary: "SUSE Bug 1024130 for CVE-2017-3143",
               url: "https://bugzilla.suse.com/1024130",
            },
            {
               category: "external",
               summary: "SUSE Bug 1046554 for CVE-2017-3143",
               url: "https://bugzilla.suse.com/1046554",
            },
            {
               category: "external",
               summary: "SUSE Bug 1046555 for CVE-2017-3143",
               url: "https://bugzilla.suse.com/1046555",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:bind-utils-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-chrootenv-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-devel-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-doc-9.9.9P1-28.37.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-32bit-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-libs-9.9.9P1-28.37.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12:bind-utils-9.9.9P1-28.37.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-06-29T20:20:16Z",
               details: "important",
            },
         ],
         title: "CVE-2017-3143",
      },
   ],
}

CVE-2017-3143 (GCVE-0-2017-3143)

Vulnerability from cvelistv5

Published

2019-01-16 20:00

Modified

2024-09-16 16:14

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

References

▼	URL	Tags
	https://kb.isc.org/docs/aa-01503	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1680	vendor-advisory, x_refsource_REDHAT
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1679	vendor-advisory, x_refsource_REDHAT
	http://www.securitytracker.com/id/1038809	vdb-entry, x_refsource_SECTRACK
	https://www.debian.org/security/2017/dsa-3904	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/99337	vdb-entry, x_refsource_BID
	https://security.netapp.com/advisory/ntap-20190830-0003/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	ISC	BIND 9	Version: 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T14:16:28.265Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/aa-01503",
               },
               {
                  name: "RHSA-2017:1680",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1680",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
               },
               {
                  name: "RHSA-2017:1679",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1679",
               },
               {
                  name: "1038809",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1038809",
               },
               {
                  name: "DSA-3904",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-3904",
               },
               {
                  name: "99337",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/99337",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20190830-0003/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND 9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.",
            },
         ],
         datePublic: "2017-06-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "A server that relies solely on TSIG keys with no other address-based ACL protection could be vulnerable to malicious zone content manipulation using this technique.\n\nNote that the local update policy (configured with \"update-policy local;\" in named.conf) implicitly defines a key with a known key name (local-ddns) and default algorithm and no IP-based access controls on the zone updates.  In conjunction with this failure in TSIG verification, \"update-policy local\" is potentially very dangerous.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-30T16:06:09",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kb.isc.org/docs/aa-01503",
            },
            {
               name: "RHSA-2017:1680",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1680",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
            },
            {
               name: "RHSA-2017:1679",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1679",
            },
            {
               name: "1038809",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1038809",
            },
            {
               name: "DSA-3904",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-3904",
            },
            {
               name: "99337",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/99337",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20190830-0003/",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads.\n\n    BIND 9 version 9.9.10-P2\n    BIND 9 version 9.10.5-P2\n    BIND 9 version 9.11.1-P2\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9 version 9.9.10-S3\n    BIND 9 version 9.10.5-S3",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "An error in TSIG authentication can permit unauthorized dynamic updates",
         workarounds: [
            {
               lang: "en",
               value: "The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in conjunction.  For information on how to configure this type of compound authentication control, please see: https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html.\n\nAdministrators who have made use of named.conf option \"update-policy local;\" should patch their servers as soon as possible and if this is not possible should replace the update-policy configuration statement with an allow-update statement implementing the key requirement for updates but additionally imposing an IP ACL limitation, e.g.:\n\nallow-update { !{ !localhost; }; key local-ddns; };",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-officer@isc.org",
               DATE_PUBLIC: "2017-06-29T00:00:00.000Z",
               ID: "CVE-2017-3143",
               STATE: "PUBLIC",
               TITLE: "An error in TSIG authentication can permit unauthorized dynamic updates",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "BIND 9",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ISC",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "A server that relies solely on TSIG keys with no other address-based ACL protection could be vulnerable to malicious zone content manipulation using this technique.\n\nNote that the local update policy (configured with \"update-policy local;\" in named.conf) implicitly defines a key with a known key name (local-ddns) and default algorithm and no IP-based access controls on the zone updates.  In conjunction with this failure in TSIG verification, \"update-policy local\" is potentially very dangerous.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://kb.isc.org/docs/aa-01503",
                     refsource: "CONFIRM",
                     url: "https://kb.isc.org/docs/aa-01503",
                  },
                  {
                     name: "RHSA-2017:1680",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1680",
                  },
                  {
                     name: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
                     refsource: "CONFIRM",
                     url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
                  },
                  {
                     name: "RHSA-2017:1679",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1679",
                  },
                  {
                     name: "1038809",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1038809",
                  },
                  {
                     name: "DSA-3904",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2017/dsa-3904",
                  },
                  {
                     name: "99337",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/99337",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20190830-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20190830-0003/",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads.\n\n    BIND 9 version 9.9.10-P2\n    BIND 9 version 9.10.5-P2\n    BIND 9 version 9.11.1-P2\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9 version 9.9.10-S3\n    BIND 9 version 9.10.5-S3",
               },
            ],
            source: {
               discovery: "UNKNOWN",
            },
            work_around: [
               {
                  lang: "en",
                  value: "The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in conjunction.  For information on how to configure this type of compound authentication control, please see: https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html.\n\nAdministrators who have made use of named.conf option \"update-policy local;\" should patch their servers as soon as possible and if this is not possible should replace the update-policy configuration statement with an allow-update statement implementing the key requirement for updates but additionally imposing an IP ACL limitation, e.g.:\n\nallow-update { !{ !localhost; }; key local-ddns; };",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2017-3143",
      datePublished: "2019-01-16T20:00:00Z",
      dateReserved: "2016-12-02T00:00:00",
      dateUpdated: "2024-09-16T16:14:21.796Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2017-3142 (GCVE-0-2017-3142)

Vulnerability from cvelistv5

Published

2019-01-16 20:00

Modified

2024-09-16 17:08

Severity ?

5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2017:1680	vendor-advisory, x_refsource_REDHAT
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1679	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/99339	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1038809	vdb-entry, x_refsource_SECTRACK
	https://www.debian.org/security/2017/dsa-3904	vendor-advisory, x_refsource_DEBIAN
	https://kb.isc.org/docs/aa-01504	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20190830-0003/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	ISC	BIND 9	Version: 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T14:16:28.215Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2017:1680",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1680",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
               },
               {
                  name: "RHSA-2017:1679",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1679",
               },
               {
                  name: "99339",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/99339",
               },
               {
                  name: "1038809",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1038809",
               },
               {
                  name: "DSA-3904",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-3904",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/aa-01504",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20190830-0003/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND 9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.",
            },
         ],
         datePublic: "2017-06-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone.  Protection of zone contents is often a commercial or business requirement. \nIf accepted, a NOTIFY sets the zone refresh interval to 'now'.  If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters.  If there is already a refresh cycle in progress, then named will queue the new refresh request.  If there is already a queued refresh request, the new NOTIFY will be discarded. Bogus notifications can't be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-30T16:06:09",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               name: "RHSA-2017:1680",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1680",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
            },
            {
               name: "RHSA-2017:1679",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1679",
            },
            {
               name: "99339",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/99339",
            },
            {
               name: "1038809",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1038809",
            },
            {
               name: "DSA-3904",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-3904",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kb.isc.org/docs/aa-01504",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20190830-0003/",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads.\n\n    BIND 9 version 9.9.10-P2\n    BIND 9 version 9.10.5-P2\n    BIND 9 version 9.11.1-P2\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9 version 9.9.10-S3\n    BIND 9 version 9.10.5-S3",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "An error in TSIG authentication can permit unauthorized zone transfers",
         workarounds: [
            {
               lang: "en",
               value: "The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in conjunction.  For information on how to configure this type of compound authentication control, please see: https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html. (Note that this technique may not be effective against bogus NOTIFY packets if an attacker is able to reach the target DNS server whilst using a spoofed sending address).",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-officer@isc.org",
               DATE_PUBLIC: "2017-06-29T00:00:00.000Z",
               ID: "CVE-2017-3142",
               STATE: "PUBLIC",
               TITLE: "An error in TSIG authentication can permit unauthorized zone transfers",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "BIND 9",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ISC",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone.  Protection of zone contents is often a commercial or business requirement. \nIf accepted, a NOTIFY sets the zone refresh interval to 'now'.  If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters.  If there is already a refresh cycle in progress, then named will queue the new refresh request.  If there is already a queued refresh request, the new NOTIFY will be discarded. Bogus notifications can't be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "RHSA-2017:1680",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1680",
                  },
                  {
                     name: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
                     refsource: "CONFIRM",
                     url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us",
                  },
                  {
                     name: "RHSA-2017:1679",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1679",
                  },
                  {
                     name: "99339",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/99339",
                  },
                  {
                     name: "1038809",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1038809",
                  },
                  {
                     name: "DSA-3904",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2017/dsa-3904",
                  },
                  {
                     name: "https://kb.isc.org/docs/aa-01504",
                     refsource: "CONFIRM",
                     url: "https://kb.isc.org/docs/aa-01504",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20190830-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20190830-0003/",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads.\n\n    BIND 9 version 9.9.10-P2\n    BIND 9 version 9.10.5-P2\n    BIND 9 version 9.11.1-P2\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9 version 9.9.10-S3\n    BIND 9 version 9.10.5-S3",
               },
            ],
            source: {
               discovery: "UNKNOWN",
            },
            work_around: [
               {
                  lang: "en",
                  value: "The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in conjunction.  For information on how to configure this type of compound authentication control, please see: https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html. (Note that this technique may not be effective against bogus NOTIFY packets if an attacker is able to reach the target DNS server whilst using a spoofed sending address).",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2017-3142",
      datePublished: "2019-01-16T20:00:00Z",
      dateReserved: "2016-12-02T00:00:00",
      dateUpdated: "2024-09-16T17:08:46.835Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

CVE-2017-3143 (GCVE-0-2017-3143)

Vulnerability from cvelistv5

CVE-2017-3142 (GCVE-0-2017-3142)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature