CVE-2017-3142 - BIND DNS Server TSIG Authentication Bypass
Summary
CVE-2017-3142: An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructe... Affects bind across 11 version ranges.
< 1c59cea1c0e26e2da3f2afb90200bfe9f7748c03
< 8a2d9ba36c16111ebb3be1a1c61fa0ebc2610c40
< 9.10.4_p8-r1
>= 63fbb3ea39094353765c04a6066b9e1d1013992a, <= feb005b1b94f0493cd69d70a77a30a15b9a62993
< 341e64a2de908ceec50ed46d243bf3402342735c
< 733de85889f4f126106ec4389d32d92046a6e1be
>= 1477c19dd9a347ee19a42dac227f299a4680506f, <= e3dc2e7b9941566190fd2691e1c71ce232f9a7c6
>= 3514c49b2fbcdf95b2735878e2487fce9a3ddad5, <= 1a7c6f9dc8b32b52a4462ec0a9b8fa40da628546
>= 600305bf9b2e7ab79b95989190f84fdcf4140cc1, <= 8fc2e36186691698d247ab040b83793a9189de73
< a39c587731ff8da751c26592838fbc04d8b62678
< e7f06a85359873b4822acac1b87a885310fd6ac2
Fixed in 9.10.4_p8-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND is an open-source DNS server software that provides domain name resolution services. It is widely used across the internet to translate domain names into IP addresses. The vulnerability, CVE-2017-3142, affects BIND versions 9.4.0 to 9.8.8, 9.9.0 to 9.9.10-P1, 9.10.0 to 9.10.5-P1, and 9.11.0 to 9.11.1-P1. This vulnerability allows an attacker with knowledge of a valid TSIG key name to bypass TSIG authentication of AXFR requests, potentially leading to unauthorized access to zone data or acceptance of bogus NOTIFY packets.
Vulnerability Detail
The vulnerability arises from a flaw in the TSIG authentication process of BIND DNS servers. An attacker who can send and receive messages to an authoritative DNS server and possesses knowledge of a valid TSIG key name can exploit this flaw. By crafting a carefully constructed request packet, the attacker can circumvent TSIG authentication. This can result in two potential scenarios: 1) The server may provide an AXFR (zone transfer) of a zone to an unauthorized recipient, allowing the attacker to access sensitive zone data. 2) The server may accept bogus NOTIFY packets, potentially disrupting the DNS infrastructure. The vulnerability has a CVSS score of 3.7, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.10.4_p8-r1
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading BIND to a fixed version.
Conclusion
CVE-2017-3142 is a vulnerability in BIND DNS servers that allows an attacker to bypass TSIG authentication. This can lead to unauthorized access to zone data or disruption of the DNS infrastructure. It is recommended to upgrade BIND to a fixed version and review TSIG key configuration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an open-source DNS server software that translates domain names into IP addresses.
The vulnerability affects BIND versions 9.4.0 to 9.8.8, 9.9.0 to 9.9.10-P1, 9.10.0 to 9.10.5-P1, and 9.11.0 to 9.11.1-P1.
An attacker can potentially access sensitive zone data by receiving an unauthorized AXFR of a zone or disrupt the DNS infrastructure by sending bogus NOTIFY packets.
The CVSS score of this vulnerability is 3.7, indicating a moderate severity level.
No, there is no known workaround for this vulnerability. It is crucial to upgrade BIND to a fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
