ISC BIND CVE-2017-3143 Security Bypass Vulnerability

by CIRT Team

27 Aug 2017

in Security Advisories & Alerts

No Comments

1214

Description: BIND is open source software that enables you to publish your Domain Name System (DNS) information on the Internet, and to resolve DNS queries for your users. An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update.

Impact: An attacker can exploit this issue to perform unauthorized actions. This may aid in further attacks. ISC BIND versions 9.4.0 through 9.8.8, 9.9.0 through 9.9.10-P1, 9.10.0 through 9.10.5-P1, 9.11.0 through 9.11.1-P1, 9.9.3-S1 through 9.9.10-S2, and 9.10.5-S1 through 9.10.5-S2 are vulnerable.

Mitigation: Updates are available. Please check specific vendor advisory for more information.

Reference URL’s: