CVE-2017-3145
Improper fetch cleanup sequencing in the resolver can cause named to crash
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 27.73 % · centile 98 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- isc
- Statut NVD
- Modified
Description
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.
Faiblesses (CWE)
- CWE-416 — Utilisation après libération
Références
- https://access.redhat.com/errata/RHSA-2018:0102
- https://access.redhat.com/errata/RHSA-2018:0487
- https://www.debian.org/security/2018/dsa-4089
- https://access.redhat.com/errata/RHSA-2018:0488
- https://access.redhat.com/errata/RHSA-2018:0101
- http://www.securitytracker.com/id/1040195
- https://kb.isc.org/docs/aa-01542
- http://www.securityfocus.com/bid/102716
- https://lists.debian.org/debian-lts-announce/2018/01/msg00029.html
- https://security.netapp.com/advisory/ntap-20180117-0003/
- https://supportportal.juniper.net/s/article/2018-07-Security-Bulletin-SRX-Series-Vulnerabilities-in-ISC-BIND-named
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | isc |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security-officer@isc.org (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-12286
- GCVE · GCVE-0-2017-3145
Avis du CERT-FR
- CERTFR-2019-AVI-014 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2018-AVI-339 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2018-AVI-033 — Vulnérabilité dans Bind · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*≥ 9.4.0 ≤ 9.8.8cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*≥ 9.9.0 ≤ 9.9.11cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*≥ 9.10.0 ≤ 9.10.6cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*≥ 9.11.0 ≤ 9.11.2cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.9.11:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.5:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.6:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:alpha1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:b1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:b2:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:rc1:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*cpe:2.3:o:juniper:junos:12.1x46-d76:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:12.3x48-d70:-:*:*:*:*:*:*- +4 autres
Produits affectés
| Produit | Versions |
|---|---|
| ISC · BIND 9 | affected 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |