CVE-2017-3135

Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 16 Jan 2019, 20:00
Last modified:16 Sept 2024, 17:53

Vulnerability Summary

Overall Risk (default)
medium
39/100
CVSS Score
7.5 HIGH
v3.0 (cve.org)
EPSS Score
45.41% HIGH
45% probability +11.15%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Jan 2019, 20:00
Published
Vulnerability first disclosed
16 Sept 2024, 17:53
Last Modified
Vulnerability information updated

Description

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.

CVSS Metrics

  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 45.41%• Percentile: 98%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • debian•debian_linux

    8.0 | 9.0

  • isc•bind

    9.9.3 | 9.9.3:s1 | 9.9.8 | 9.9.9:p5 | 9.9.9:s7 | 9.9.10:beta1 | 9.10.0 | 9.10.4:p1 | 9.10.4:p2 | 9.10.4:p3 | 9.10.4:p4 | 9.10.4:p5 | 9.10.5:beta1 | 9.11.0 | 9.11.0:p1 | 9.11.0:p2 | 9.11.1:beta1

  • isc•bind 9

    BIND 9 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1

  • netapp•data_ontap_edge

    na

  • netapp•element_software_management_node

    na

  • redhat•enterprise_linux_desktop

    7.0

  • redhat•enterprise_linux_server

    7.0

  • redhat•enterprise_linux_server_aus

    7.3 | 7.4 | 7.6

  • redhat•enterprise_linux_server_eus

    7.3 | 7.4 | 7.5 | 7.6

  • redhat•enterprise_linux_server_tus

    7.3 | 7.6

  • redhat•enterprise_linux_workstation

    7.0

References (8)