CVE-2017-3137 : Vulnerability Insights and Analysis
Learn about CVE-2017-3137, a BIND 9 vulnerability allowing denial of service attacks by manipulating response packets. Find mitigation steps and upgrade recommendations here.
A vulnerability in BIND 9 could allow an attacker to cause a denial of service by sending a response packet containing CNAME or DNAME resource records with a specific order, leading to a resolver termination.
Understanding CVE-2017-3137
This CVE involves a flaw in the handling of records in the response's answer section, impacting various versions of BIND.
What is CVE-2017-3137?
The vulnerability arises from incorrect assumptions about the order of records in response packets containing CNAME or DNAME resource records, potentially triggering an assertion failure in named.
The Impact of CVE-2017-3137
The vulnerability has a CVSS base score of 7.5 (High severity) and could result in a denial of service due to an assertion failure in named when processing responses with specific record orderings.
Technical Details of CVE-2017-3137
This section delves into the specifics of the vulnerability.
Vulnerability Description
The flaw in BIND 9 could lead to a denial of service by causing named to exit with an assertion failure when processing responses with CNAME or DNAME records in an unexpected order.
Affected Systems and Versions
- BIND 9 versions 9.9.9-P6, 9.9.10b1->9.9.10rc1
- BIND 9 versions 9.10.4-P6, 9.10.5b1->9.10.5rc1
- BIND 9 versions 9.11.0-P3, 9.11.1b1->9.11.1rc1
- BIND 9 version 9.9.9-S8
Exploitation Mechanism
An attacker can exploit this vulnerability by crafting a response packet with CNAME or DNAME resource records in a specific order, causing a resolver to terminate.
Mitigation and Prevention
Protect your systems from CVE-2017-3137 with these strategies.
Immediate Steps to Take
- Upgrade to the patched release closest to your current BIND version.
Long-Term Security Practices
- Regularly update BIND to the latest versions to ensure protection against known vulnerabilities.
Patching and Updates
- Download the patched releases from the official ISC website.
- Consider using the BIND Supported Preview Edition for additional features and support.
- Look out for upcoming maintenance releases containing fixes for this vulnerability.