CVE-2017-3138
Summary
| CVE | CVE-2017-3138 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-01-16 20:29:00 UTC |
| Updated | 2019-10-09 23:27:00 UTC |
| Description | named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9. |
Risk And Classification
Problem Types: CWE-617
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Isc | Bind | 9.10.4 | All | All | All |
| Application | Isc | Bind | 9.10.4 | p1 | All | All |
| Application | Isc | Bind | 9.10.4 | p2 | All | All |
| Application | Isc | Bind | 9.10.4 | p3 | All | All |
| Application | Isc | Bind | 9.10.4 | p4 | All | All |
| Application | Isc | Bind | 9.10.4 | p5 | All | All |
| Application | Isc | Bind | 9.10.4 | p6 | All | All |
| Application | Isc | Bind | 9.10.4 | p7 | All | All |
| Application | Isc | Bind | 9.10.5 | b1 | All | All |
| Application | Isc | Bind | 9.10.5 | rc1 | All | All |
| Application | Isc | Bind | 9.10.5 | rc2 | All | All |
| Application | Isc | Bind | 9.11.0 | All | All | All |
| Application | Isc | Bind | 9.11.0 | p1 | All | All |
| Application | Isc | Bind | 9.11.0 | p2 | All | All |
| Application | Isc | Bind | 9.11.0 | p3 | All | All |
| Application | Isc | Bind | 9.11.0 | p4 | All | All |
| Application | Isc | Bind | 9.11.1 | b1 | All | All |
| Application | Isc | Bind | 9.11.1 | rc1 | All | All |
| Application | Isc | Bind | 9.11.1 | rc2 | All | All |
| Application | Isc | Bind | 9.9.10 | beta1 | All | All |
| Application | Isc | Bind | 9.9.10 | rc1 | All | All |
| Application | Isc | Bind | 9.9.10 | rc2 | All | All |
| Application | Isc | Bind | 9.9.9 | All | All | All |
| Application | Isc | Bind | 9.9.9 | p1 | All | All |
| Application | Isc | Bind | 9.9.9 | p2 | All | All |
| Application | Isc | Bind | 9.9.9 | p3 | All | All |
| Application | Isc | Bind | 9.9.9 | p4 | All | All |
| Application | Isc | Bind | 9.9.9 | p5 | All | All |
| Application | Isc | Bind | 9.9.9 | p6 | All | All |
| Application | Isc | Bind | 9.9.9 | p7 | All | All |
| Application | Isc | Bind | 9.9.9 | s1 | All | All |
| Application | Isc | Bind | 9.9.9 | s7 | All | All |
| Application | Isc | Bind | 9.10.4 | All | All | All |
| Application | Isc | Bind | 9.10.4 | p1 | All | All |
| Application | Isc | Bind | 9.10.4 | p2 | All | All |
| Application | Isc | Bind | 9.10.4 | p3 | All | All |
| Application | Isc | Bind | 9.10.4 | p4 | All | All |
| Application | Isc | Bind | 9.10.4 | p5 | All | All |
| Application | Isc | Bind | 9.10.4 | p6 | All | All |
| Application | Isc | Bind | 9.10.4 | p7 | All | All |
| Application | Isc | Bind | 9.10.5 | b1 | All | All |
| Application | Isc | Bind | 9.10.5 | rc1 | All | All |
| Application | Isc | Bind | 9.10.5 | rc2 | All | All |
| Application | Isc | Bind | 9.11.0 | All | All | All |
| Application | Isc | Bind | 9.11.0 | p1 | All | All |
| Application | Isc | Bind | 9.11.0 | p2 | All | All |
| Application | Isc | Bind | 9.11.0 | p3 | All | All |
| Application | Isc | Bind | 9.11.0 | p4 | All | All |
| Application | Isc | Bind | 9.11.1 | b1 | All | All |
| Application | Isc | Bind | 9.11.1 | rc1 | All | All |
| Application | Isc | Bind | 9.11.1 | rc2 | All | All |
| Application | Isc | Bind | 9.9.10 | beta1 | All | All |
| Application | Isc | Bind | 9.9.10 | rc1 | All | All |
| Application | Isc | Bind | 9.9.10 | rc2 | All | All |
| Application | Isc | Bind | 9.9.9 | All | All | All |
| Application | Isc | Bind | 9.9.9 | p1 | All | All |
| Application | Isc | Bind | 9.9.9 | p2 | All | All |
| Application | Isc | Bind | 9.9.9 | p3 | All | All |
| Application | Isc | Bind | 9.9.9 | p4 | All | All |
| Application | Isc | Bind | 9.9.9 | p5 | All | All |
| Application | Isc | Bind | 9.9.9 | p6 | All | All |
| Application | Isc | Bind | 9.9.9 | p7 | All | All |
| Application | Isc | Bind | 9.9.9 | s1 | All | All |
| Application | Isc | Bind | 9.9.9 | s7 | All | All |
| Application | Netapp | Data Ontap Edge | - | All | All | All |
| Application | Netapp | Data Ontap Edge | - | All | All | All |
| Application | Netapp | Element Software | - | All | All | All |
| Application | Netapp | Element Software | - | All | All | All |
| Application | Netapp | Oncommand Balance | - | All | All | All |
| Application | Netapp | Oncommand Balance | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-3854-1 bind9 | DEBIAN | www.debian.org | Third Party Advisory |
| April 2017 ISC BIND Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| CVE-2017-3138: named exits with a REQUIRE assertion failure if it receives a null command string on its control channel - Security Advisories | CONFIRM | kb.isc.org | Vendor Advisory |
| ISC BIND CVE-2017-3138 Remote Denial of Service Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| BIND Null Command String Processing Lets Remote Users on Authorized Hosts Cause the Target Service to Crash - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| BIND: Multiple vulnerabilities (GLSA 201708-01) — Gentoo Security | GENTOO | security.gentoo.org | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: ISC would like to thank Mike Lalumiere of Dyn, Inc., for bringing this issue to our attention.