bind9 - Regression Update
Summary
DLA-1025-2: bind9 - regression update. Affects bind9 versions < 1:9.8.4.dfsg.P1-6+nmu2+deb7u18. Fixed in 1:9.8.4.dfsg.P1-6+nmu2+deb7u18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bind9 is a DNS server software package that provides domain name resolution services. It is widely used as the default DNS server in many Linux distributions, including Debian 7 Wheezy. This vulnerability affects bind9 in Debian 7 Wheezy.
Vulnerability Detail
The vulnerability, identified as CVE-2017-3142 and CVE-2017-3143, allows an attacker who can send and receive messages to an authoritative DNS server to bypass TSIG authentication and perform unauthorized actions. In the case of CVE-2017-3142, an attacker with knowledge of a valid TSIG key name can manipulate the server into providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. CVE-2017-3143 enables an attacker to manipulate BIND into accepting an unauthorized dynamic update if they have knowledge of a valid TSIG key name for the targeted zone and service.
How To Fix
Minimum fixed version
1:9.8.4.dfsg.P1-6+nmu2+deb7u18
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The bind9 package in Debian 7 Wheezy is vulnerable to two issues, CVE-2017-3142 and CVE-2017-3143. Upgrading to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u17 or later will address these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind9 →
FAQ
bind9 is a DNS server software package that provides domain name resolution services.
This vulnerability affects bind9 in Debian 7 Wheezy.
CVE-2017-3142 allows an attacker to bypass TSIG authentication and perform unauthorized actions, such as obtaining an AXFR of a zone or sending bogus NOTIFY packets.
CVE-2017-3143 enables an attacker to perform unauthorized dynamic updates if they have knowledge of a valid TSIG key name for the targeted zone and service.
To fix this vulnerability, upgrade the bind9 package to version 1:9.8.4.dfsg.P1-6+nmu2+deb7u17 or later.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
