CVE-2017-3145
high · 7.5BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.
7.5
CVSS
27.9%
EPSS (exploit prob.)
98th
EPSS percentile
2019-01-16
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-416
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| isc | bind | >= 9.4.0, <= 9.8.8 |
| isc | bind | >= 9.9.0, <= 9.9.11 |
| isc | bind | >= 9.10.0, <= 9.10.6 |
| isc | bind | >= 9.11.0, <= 9.11.2 |
| isc | bind | 9.9.3 |
| isc | bind | 9.9.11 |
| isc | bind | 9.10.5 |
| isc | bind | 9.10.6 |
| isc | bind | 9.12.0 |
| isc | bind | 9.12.0 |
| isc | bind | 9.12.0 |
| isc | bind | 9.12.0 |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 6.4 |
| redhat | enterprise_linux_server_aus | 6.5 |
| redhat | enterprise_linux_server_aus | 6.6 |
| redhat | enterprise_linux_server_aus | 7.2 |
| redhat | enterprise_linux_server_aus | 7.3 |
| redhat | enterprise_linux_server_aus | 7.4 |
| redhat | enterprise_linux_server_aus | 7.6 |
| redhat | enterprise_linux_server_eus | 6.7 |
| redhat | enterprise_linux_server_eus | 7.3 |
| redhat | enterprise_linux_server_eus | 7.4 |
| redhat | enterprise_linux_server_eus | 7.5 |
| redhat | enterprise_linux_server_eus | 7.6 |
| redhat | enterprise_linux_server_tus | 6.6 |
| redhat | enterprise_linux_server_tus | 7.2 |
| redhat | enterprise_linux_server_tus | 7.3 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_workstation | 6.0 |
| redhat | enterprise_linux_workstation | 7.0 |
| debian | debian_linux | 7.0 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| netapp | data_ontap_edge | all versions |
| juniper | junos | 12.1x46-d76 |
| juniper | junos | 12.3x48-d70 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/102716
- http://www.securitytracker.com/id/1040195
- https://access.redhat.com/errata/RHSA-2018:0101
- https://access.redhat.com/errata/RHSA-2018:0102
- https://access.redhat.com/errata/RHSA-2018:0487
- https://access.redhat.com/errata/RHSA-2018:0488
- https://kb.isc.org/docs/aa-01542
- https://lists.debian.org/debian-lts-announce/2018/01/msg00029.html
- https://security.netapp.com/advisory/ntap-20180117-0003/
- https://supportportal.juniper.net/s/article/2018-07-Security-Bulletin-SRX-Series-Vulnerabilities-in-ISC-BIND-named
- https://www.debian.org/security/2018/dsa-4089
- http://www.securityfocus.com/bid/102716
- http://www.securitytracker.com/id/1040195
- https://access.redhat.com/errata/RHSA-2018:0101
- https://access.redhat.com/errata/RHSA-2018:0102
- https://access.redhat.com/errata/RHSA-2018:0487
- https://access.redhat.com/errata/RHSA-2018:0488
- https://kb.isc.org/docs/aa-01542
- https://lists.debian.org/debian-lts-announce/2018/01/msg00029.html
- https://security.netapp.com/advisory/ntap-20180117-0003/
- https://supportportal.juniper.net/s/article/2018-07-Security-Bulletin-SRX-Series-Vulnerabilities-in-ISC-BIND-named
- https://www.debian.org/security/2018/dsa-4089
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2017-3145