Critical Vulnerability in BIND Package: Assertion Failure Due to Null Command String
Summary
ALPINE-CVE-2017-3138: named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. Affects bind versions < 9.11.0_p5-r0. Fixed in 9.11.0_p5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a robust and flexible solution for managing domain name resolution. It is essential for the functioning of the internet, allowing users to access websites using human-readable domain names instead of numerical IP addresses. The package is known for its reliability and extensive feature set, but it has been found vulnerable to a specific issue that can lead to server crashes under certain conditions.
Vulnerability Detail
The vulnerability arises from a regression introduced in a recent feature change within the BIND package. It allows operators to issue commands to a running server via a control channel using a utility program like rndc. However, if a null command string is sent to the server, it can cause the named process to exit unexpectedly with a REQUIRE assertion failure. This affects several versions of BIND, specifically from 9.9.9 to 9.11.1rc2, leading to potential service disruptions and denial of service.
How To Fix
Minimum fixed version
9.11.0_p5-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, operators can avoid sending null command strings to the server to prevent triggering the assertion failure. Monitoring and controlling command inputs can help mitigate the risk until the package is updated.
Conclusion
The identified vulnerability in the BIND package poses a significant risk of server crashes due to null command strings. It is crucial for users to update to the patched version to ensure system stability and security. Utilizing tools like Vulert can further enhance vulnerability management and awareness.
See every vulnerability recorded for bind →
FAQ
The vulnerability affects BIND versions from 9.9.9 to 9.11.1rc2.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that no null command strings are sent to the server as a temporary workaround.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
