Critical Use-After-Free Vulnerability in BIND Package
Summary
ALPINE-CVE-2017-3145: BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects bind versions < 9.11.2_p1-r0. Fixed in 9.11.2_p1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that facilitates the translation of domain names into IP addresses, enabling users to access websites using human-readable names. It is known for its robustness, flexibility, and extensive feature set, making it a cornerstone of internet infrastructure. However, BIND has been found to be vulnerable to a critical use-after-free issue, which can lead to denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2017-3145, arises from improper sequencing of cleanup operations on upstream recursion fetch contexts within BIND. This flaw can lead to a use-after-free error, potentially causing an assertion failure and crashing the named service. Affected versions include BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, and 9.11.0 to 9.11.2, among others. The ramifications of this vulnerability are significant, as it can disrupt DNS services, leading to service outages and impacting users' ability to access websites.
How To Fix
Minimum fixed version
9.11.2_p1-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level protections such as firewalls to restrict access to the DNS service or using alternative DNS services temporarily until the patch can be applied.
Conclusion
The CVE-2017-3145 vulnerability in the BIND package poses a significant risk to DNS services, potentially leading to service disruptions. It is crucial for users to update to the patched version to safeguard their systems. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for bind →
FAQ
CVE-2017-3145 is a critical vulnerability in the BIND DNS server software that can lead to denial of service due to a use-after-free error.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can cause the BIND service to crash, leading to service outages and disrupting DNS resolution for users.
Yes, the patched version for Alpine Linux is 9.11.2_p1-r0. Updating to this version will mitigate the vulnerability.
If you cannot update immediately, consider implementing network-level protections such as firewalls to limit access to the DNS service.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
