Denial-of-Service Vulnerability in BIND Package: CVE-2017-3136
Summary
ALPINE-CVE-2017-3136: A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. Affects bind versions < 9.11.0_p5-r0. Fixed in 9.11.0_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides name resolution services for the internet. It is known for its robustness and flexibility, supporting various DNS features. However, certain configurations, particularly those utilizing DNS64, can expose BIND to specific vulnerabilities, including CVE-2017-3136, which can lead to denial-of-service attacks.
Vulnerability Detail
CVE-2017-3136 is a vulnerability in BIND that arises from a flaw in the DNS64 feature. An attacker can exploit this vulnerability by crafting a specific DNS query that triggers an assertion failure in the server, causing it to terminate unexpectedly. This can lead to service disruptions, particularly for servers configured to use DNS64. The affected versions include BIND 9.8.0 through 9.8.8-P1, 9.9.0 through 9.9.9-P6, and 9.11.0 through 9.11.0-P3, among others.
How To Fix
Minimum fixed version
9.11.0_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the DNS64 feature in your BIND configuration to prevent exploitation of this vulnerability. This can be done by editing the named.conf file and removing or commenting out the DNS64 configuration.
Conclusion
CVE-2017-3136 represents a significant vulnerability in the BIND DNS server software, particularly affecting those using the DNS64 feature. It is crucial to update to the patched version to mitigate the risk of denial-of-service attacks. Users should also consider disabling DNS64 as a temporary workaround if immediate patching is not possible.
See every vulnerability recorded for bind →
FAQ
CVE-2017-3136 is a vulnerability in the BIND DNS server software that can lead to denial-of-service attacks when DNS64 is enabled.
Check the version of your BIND installation. If it falls within the affected versions (e.g., 9.8.0 to 9.11.0-P3), it is vulnerable.
Exploitation of this vulnerability can cause the BIND server to crash, leading to service interruptions and potential denial-of-service for users.
Yes, you can use tools like Vulert, which monitors open-source vulnerabilities in your software using a manifest file.
The CVSS score for CVE-2017-3136 is 5.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
