ISC BIND CVE-2017-3142 Security Bypass Vulnerability

by CIRT Team

27 Aug 2017

in Security Advisories & Alerts

No Comments

2156

Description: BIND is open source software that enables you to publish your Domain Name System (DNS) information on the Internet, and to resolve DNS queries for your users. An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into:

providing an AXFR of a zone to an unauthorized recipient
accepting bogus NOTIFY packets

Impact: An attacker can exploit this issue to perform unauthorized actions. This may aid in further attacks. ISC BIND versions 9.4.0 through 9.8.8, 9.9.0 through 9.9.10-P1, 9.10.0 through 9.10.5-P1, 9.11.0 through 9.11.1-P1, 9.9.3-S1 through 9.9.10-S2, and 9.10.5-S1 through 9.10.5-S2 are vulnerable.

Mitigation: Updates are available. Please check specific vendor advisory for more information.

Reference URL’s: