CVE-2017-3138

named exits with a REQUIRE assertion failure if it receives a null command string on its control channel

Severity Score

5.3

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.

named contiene una característica que permite que los operadores envíe comandos a un servidor en ejecución comunicándose con el proceso del servidor mediante un canal de control utilizando un programa como rndc. Una regresión empleada en un cambio de características reciente ha creado una situación en la cual algunas versiones de named pueden cerrarse con un error de aserción de REQUIRE si se le envía una cadena de comandos null. Afecta a BIND desde la versión 9.9.9 hasta la 9.9.9-P7, desde la versión 9.9.10b1 hasta la 9.9.10rc2, desde la versión 9.10.4 hasta la 9.10.4-P7, desde la versión 9.10.5b1 hasta la 9.10.5rc2, desde la versión 9.10.5b1 hasta la 9.10.5rc2, desde la versión 9.11.0 hasta la 9.11.0-P4, desde la versión 9.11.1b1 hasta la 9.11.1rc2 y desde la versión 9.9.9-S1 hasta 9.9.9-S9.

*Credits: ISC would like to thank Mike Lalumiere of Dyn, Inc., for bringing this issue to our attention.

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2016-12-02 CVE Reserved
2017-04-14 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-617: Reachable Assertion

CAPEC

References (6)

URL	Tag	Source
http://www.securityfocus.com/bid/97657	Third Party Advisory
http://www.securitytracker.com/id/1038260	Third Party Advisory
https://security.netapp.com/advisory/ntap-20180802-0002	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://kb.isc.org/docs/aa-01471	2019-10-09
https://security.gentoo.org/glsa/201708-01	2019-10-09
https://www.debian.org/security/2017/dsa-3854	2019-10-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		-		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p2		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p3		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p4		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p5		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p6		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		p7		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		s1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.9 Search vendor "Isc" for product "Bind" and version "9.9.9"		s7		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.10 Search vendor "Isc" for product "Bind" and version "9.9.10"		beta1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.10 Search vendor "Isc" for product "Bind" and version "9.9.10"		rc1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.10 Search vendor "Isc" for product "Bind" and version "9.9.10"		rc2		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		-		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p2		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p3		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p4		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p5		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p6		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.4 Search vendor "Isc" for product "Bind" and version "9.10.4"		p7		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.5 Search vendor "Isc" for product "Bind" and version "9.10.5"		b1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.5 Search vendor "Isc" for product "Bind" and version "9.10.5"		rc1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.5 Search vendor "Isc" for product "Bind" and version "9.10.5"		rc2		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.0 Search vendor "Isc" for product "Bind" and version "9.11.0"		-		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.0 Search vendor "Isc" for product "Bind" and version "9.11.0"		p1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.0 Search vendor "Isc" for product "Bind" and version "9.11.0"		p2		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.0 Search vendor "Isc" for product "Bind" and version "9.11.0"		p3		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.0 Search vendor "Isc" for product "Bind" and version "9.11.0"		p4		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.1 Search vendor "Isc" for product "Bind" and version "9.11.1"		b1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.1 Search vendor "Isc" for product "Bind" and version "9.11.1"		rc1		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.1 Search vendor "Isc" for product "Bind" and version "9.11.1"		rc2		Affected
Netapp Search vendor "Netapp"		Data Ontap Edge Search vendor "Netapp" for product "Data Ontap Edge"				-		-		Affected
Netapp Search vendor "Netapp"		Element Software Search vendor "Netapp" for product "Element Software"				-		-		Affected
Netapp Search vendor "Netapp"		Oncommand Balance Search vendor "Netapp" for product "Oncommand Balance"				-		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected