Vulnerability in BIND package (CVE-2017-3137)
Summary
CVE-2017-3137: Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when process... Affects bind across 10 version ranges.
< 9.11.0_p5-r0
< 66d4de0075b24a264b19bd594835f66a17f51385
< 67d38a63139de8be0f3a307d1f6a9ad16770edac
< 341e64a2de908ceec50ed46d243bf3402342735c
< a23f742c3d767f41bfb1a143b0605a766936c4d9
< a6837d0b7879b828a394bfab852dc1b45e7fbc8b
< af51affcff016f48f5e221ffddd795865cea80d4
< c7fb2ad1605536230063bdbfd31dc9c2874f5ecd
< e7f06a85359873b4822acac1b87a885310fd6ac2
< ece26dd7d7f8b61e854ecb59325c18b3d3c8630a
Fixed in 9.11.0_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND is an open-source software package that provides DNS (Domain Name System) functionality. It is widely used for translating domain names into IP addresses and vice versa. The package is crucial for the proper functioning of the internet infrastructure. However, a vulnerability has been discovered in BIND that could lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2017-3137, arises from mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records. This flaw can be exploited by an attacker to cause BIND to exit with an assertion failure. The vulnerability affects various versions of BIND, including 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, and 9.11.0-P3, among others. The severity of this vulnerability is rated as 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Minimum fixed version
9.11.0_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the BIND package.
Conclusion
In conclusion, the vulnerability in the BIND package (CVE-2017-3137) could lead to a denial of service (DoS) attack. It is crucial to update the BIND package to the recommended version to mitigate the risk of potential attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an open-source software package that provides DNS functionality, translating domain names into IP addresses and vice versa.
The vulnerability in BIND could lead to a denial of service (DoS) attack, potentially disrupting DNS functionality.
Various versions of BIND are affected, including 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, and 9.11.0-P3, among others.
The severity of this vulnerability is rated as 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
To fix this vulnerability, update the BIND package to version 9.11.0_p5-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
