CVE-2017-3137 A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME
HighCVSS 7.5
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bind9(Debian:12) | < 1:9.10.3.dfsg.P4-12.3 | 1:9.10.3.dfsg.P4-12.3 |
| debian/bind9(Debian:13) | < 1:9.10.3.dfsg.P4-12.3 | 1:9.10.3.dfsg.P4-12.3 |
| debian/bind9(Debian:14) | < 1:9.10.3.dfsg.P4-12.3 | 1:9.10.3.dfsg.P4-12.3 |
| isc bind | = 9.9.9-p6 | No fix listed |
| isc bind | = 9.9.9-s8 | No fix listed |
| isc bind | = 9.9.10-beta1 | No fix listed |
| isc bind | = 9.9.10-rc1 | No fix listed |
| isc bind | = 9.10.4-p6 | No fix listed |
| isc bind | = 9.10.5-b1 | No fix listed |
| isc bind | = 9.10.5-rc1 | No fix listed |
| isc bind | = 9.11.0-p3 | No fix listed |
| isc bind | = 9.11.1-b1 | No fix listed |
| isc bind | = 9.11.1-rc1 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 6.2 | No fix listed |
| redhat enterprise linux server aus | = 6.4 | No fix listed |
| redhat enterprise linux server aus | = 6.5 | No fix listed |
| redhat enterprise linux server aus | = 6.6 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server eus | = 6.7 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 6.5 | No fix listed |
| redhat enterprise linux server tus | = 6.6 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| netapp data ontap edge | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| debian linux | = 8.0 | No fix listed |
| alpine/bind(Alpine:v3.10) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.11) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.12) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.13) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.14) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.15) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.16) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.17) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.18) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.19) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.2) | < 9.10.4_p8 | 9.10.4_p8 |
| alpine/bind(Alpine:v3.20) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.21) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.22) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.23) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.24) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.3) | < 9.10.4_p8-r0 | 9.10.4_p8-r0 |
| alpine/bind(Alpine:v3.5) | < 9.10.4_p8-r0 | 9.10.4_p8-r0 |
| alpine/bind(Alpine:v3.6) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.7) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.8) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| alpine/bind(Alpine:v3.9) | < 9.11.0_p5-r0 | 9.11.0_p5-r0 |
| isc BIND 9 | = 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8 | No fix listed |
References
- Debian Security Tracker CVE-2017-3137 vendor-advisory
- 97651 third-party-advisory vdb-entry
- 1038258 third-party-advisory vdb-entry
- 1040195 third-party-advisory vdb-entry
- RHSA-2017:1095 third-party-advisory vendor-advisory
- RHSA-2017:1105 third-party-advisory vendor-advisory
- RHSA-2017:1582 third-party-advisory vendor-advisory
- RHSA-2017:1583 third-party-advisory vendor-advisory
- kb.isc.org vendor-advisory
- GLSA-201708-01 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- DSA-3854 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking