CVE-2017-3140 An error processing RPZ rules can cause named to loop endlessly after handling a query
MediumCVSS 5.9
EPSS 12.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isc bind | >= 9.11.0, <= 9.11.1 | No fix listed |
| isc bind | = 9.9.10 | No fix listed |
| isc bind | = 9.9.10-s1 | No fix listed |
| isc bind | = 9.10.5 | No fix listed |
| isc bind | = 9.10.5-s1 | No fix listed |
| netapp data ontap edge | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| alpine/bind(Alpine:v3.6) | >= 9.11.0, < 9.11.3-r0 | 9.11.3-r0 |
| alpine/bind(Alpine:v3.7) | >= 9.11.0, < 9.11.3-r0 | 9.11.3-r0 |
| isc BIND 9 | = 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1 | No fix listed |
References
- 99088 third-party-advisory vdb-entry
- 1038692 third-party-advisory vdb-entry
- h20566.www2.hpe.com third-party-advisory
- kb.isc.org vendor-advisory
- GLSA-201708-01 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- security.alpinelinux.org vendor-advisory
- Debian Security Tracker CVE-2017-3140 vendor-advisory