Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.703854
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 3854-1 (bind9 - security update)
Summary:Several vulnerabilities were discovered in BIND, a DNS server;implementation. The Common Vulnerabilities and Exposures project;identifies the following problems:;;CVE-2017-3136;Oleg Gorokhov of Yandex discovered that BIND does not properly;handle certain queries when using DNS64 with the 'break-dnssec yes';option, allowing a remote attacker to cause a denial-of-service.;;CVE-2017-3137;It was discovered that BIND makes incorrect assumptions about the;ordering of records in the answer section of a response containing;CNAME or DNAME resource records, leading to situations where BIND;exits with an assertion failure. An attacker can take advantage of;this condition to cause a denial-of-service.;;CVE-2017-3138Mike Lalumiere of Dyn, Inc. discovered that BIND can exit with a;REQUIRE assertion failure if it receives a null command string on;its control channel. Note that the fix applied in Debian is only;applied as a hardening measure.
Description:Summary:
Several vulnerabilities were discovered in BIND, a DNS server
implementation. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2017-3136
Oleg Gorokhov of Yandex discovered that BIND does not properly
handle certain queries when using DNS64 with the 'break-dnssec yes'
option, allowing a remote attacker to cause a denial-of-service.

CVE-2017-3137
It was discovered that BIND makes incorrect assumptions about the
ordering of records in the answer section of a response containing
CNAME or DNAME resource records, leading to situations where BIND
exits with an assertion failure. An attacker can take advantage of
this condition to cause a denial-of-service.

CVE-2017-3138Mike Lalumiere of Dyn, Inc. discovered that BIND can exit with a
REQUIRE assertion failure if it receives a null command string on
its control channel. Note that the fix applied in Debian is only
applied as a hardening measure.

Affected Software/OS:
bind9 on Debian Linux

Solution:
For the stable distribution (jessie), these problems have been fixed in
version 1:9.9.5.dfsg-9+deb8u11.

For the unstable distribution (sid), these problems have been fixed in
version 1:9.10.3.dfsg.P4-12.3.

We recommend that you upgrade your bind9 packages.

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2017-3136
BugTraq ID: 97653
http://www.securityfocus.com/bid/97653
Debian Security Information: DSA-3854 (Google Search)
https://www.debian.org/security/2017/dsa-3854
https://security.gentoo.org/glsa/201708-01
RedHat Security Advisories: RHSA-2017:1095
https://access.redhat.com/errata/RHSA-2017:1095
RedHat Security Advisories: RHSA-2017:1105
https://access.redhat.com/errata/RHSA-2017:1105
http://www.securitytracker.com/id/1038259
SuSE Security Announcement: openSUSE-SU-2020:1699 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
SuSE Security Announcement: openSUSE-SU-2020:1701 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
Common Vulnerability Exposure (CVE) ID: CVE-2017-3137
BugTraq ID: 97651
http://www.securityfocus.com/bid/97651
RedHat Security Advisories: RHSA-2017:1582
https://access.redhat.com/errata/RHSA-2017:1582
RedHat Security Advisories: RHSA-2017:1583
https://access.redhat.com/errata/RHSA-2017:1583
http://www.securitytracker.com/id/1038258
http://www.securitytracker.com/id/1040195
Common Vulnerability Exposure (CVE) ID: CVE-2017-3138
BugTraq ID: 97657
http://www.securityfocus.com/bid/97657
http://www.securitytracker.com/id/1038260
CopyrightCopyright (C) 2017 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.