Critical Vulnerability in BIND Package: CNAME/DNAME Record Processing Flaw
Summary
ALPINE-CVE-2017-3137: Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when process... Affects bind versions < 9.11.0_p5-r0. Fixed in 9.11.0_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that enables the translation of domain names into IP addresses. It is known for its robustness, flexibility, and extensive feature set, making it a cornerstone of internet infrastructure. However, BIND is susceptible to various vulnerabilities, including the one described here, which can lead to severe operational disruptions if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2017-3137, arises from mistaken assumptions about the ordering of records in the answer section of a DNS response containing CNAME or DNAME resource records. This flaw can lead to an assertion failure in the named process, causing it to exit unexpectedly when processing responses with unusual record orders. The affected versions include BIND 9.9.9-P6, 9.9.10b1 to 9.9.10rc1, 9.10.4-P6, 9.10.5b1 to 9.10.5rc1, and 9.11.0-P3, among others. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.11.0_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing strict input validation for DNS responses and monitoring logs for unusual activity related to DNS queries. However, this does not replace the need for an update.
Conclusion
The CVE-2017-3137 vulnerability in the BIND package poses a significant risk to DNS operations, with the potential for service disruptions. It is crucial to update to the patched version to ensure the security and reliability of DNS services. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bind →
FAQ
CVE-2017-3137 is a vulnerability in the BIND DNS server that can cause the named process to exit unexpectedly due to improper handling of CNAME or DNAME records.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to service disruptions, making DNS resolution unreliable and potentially affecting all services relying on DNS.
Yes, the patched version of BIND is 9.11.0_p5-r0 for Alpine Linux. It is crucial to update to this version to mitigate the risk.
If immediate updates are not possible, implement strict input validation and monitor DNS logs for any unusual activity as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
