CVE-2017-3141: isc bind Unquoted Search Path or Element
Vulnerability summary
CVE-2017-3141 is a high (CVSS 7.8) Unquoted Search Path or Element vulnerability in isc bind. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 16-01-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA7.2HighCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.43% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundBIND 9.10.5 - Unquoted Service Path Privilege Escalation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Isc2 products
Alpine1 product
- bind≥ 9.2.6, < 9.11.3-r0
2 vendors · 3 products