named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion
    failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service
    against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects
    BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1,
    9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8. (CVE-2017-3136)

  - Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or
    DNAME resource records could lead to a situation in which named would exit with an assertion failure when
    processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6,
    9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.
    (CVE-2017-3137)

  - named contains a feature which allows operators to issue commands to a running server by communicating
    with the server process over a control channel, using a utility program such as rndc. A regression
    introduced in a recent feature change has created a situation under which some versions of named can be
    caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND
    9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4,
    9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9. (CVE-2017-3138)

The remote host is affected by the vulnerability described in GLSA-201708-01 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted DNS request to the BIND       resolver resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2017-3136, CVE-2017-3137 and CVE-2017-3138

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-3136

Oleg Gorokhov of Yandex discovered that BIND does not properly handle certain queries when using DNS64 with the 'break-dnssec yes;' option, allowing a remote attacker to cause a denial of service.

CVE-2017-3137

It was discovered that BIND makes incorrect assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records, leading to situations where BIND exits with an assertion failure. An attacker can take advantage of this condition to cause a denial of service.

CVE-2017-3138

Mike Lalumiere of Dyn, Inc. discovered that BIND can exit with a REQUIRE assertion failure if it receives a null command string on its control channel. Note that the fix applied in Debian is only applied as a hardening measure. Details about the issue can be found at https://kb.isc.org/article/AA-01471 .

For Debian 7 'Wheezy', these problems have been fixed in version 1:9.8.4.dfsg.P1-6+nmu2+deb7u16.

We recommend that you upgrade your bind9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in BIND, a DNS server implementation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-3136     Oleg Gorokhov of Yandex discovered that BIND does not     properly handle certain queries when using DNS64 with     the 'break-dnssec yes;' option, allowing a remote     attacker to cause a denial-of-service.

  - CVE-2017-3137     It was discovered that BIND makes incorrect assumptions     about the ordering of records in the answer section of a     response containing CNAME or DNAME resource records,     leading to situations where BIND exits with an assertion     failure. An attacker can take advantage of this     condition to cause a denial-of-service.

  - CVE-2017-3138     Mike Lalumiere of Dyn, Inc. discovered that BIND can     exit with a REQUIRE assertion failure if it receives a     null command string on its control channel. Note that     the fix applied in Debian is only applied as a hardening     measure. Details about the issue can be found at     https://kb.isc.org/article/AA-01471 .

This update for bind fixes the following issues :

CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion.

CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64.

CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure.

CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response.
IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message.

CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

One additional non-security bug was fixed :

The default umask was changed to 077. (bsc#1020983)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.9.x prior to 9.9.9-P8 or 9.9.9-S10, 9.10.x prior to 9.10.4-P8, or 9.11.x prior to 9.11.0-P5. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in DNS64 when     handling certain queries for synthesized records. An     unauthenticated, remote attacker can exploit this, via a     specially crafted query, to cause an assertion failure,     resulting in DNS64 terminating. Note that issue applies     if the server is configured to use DNS64 and if the     option 'break-dnssec yes;' is in use. (CVE-2017-3136)

  - A denial of service vulnerability exists when handling     specially crafted responses containing CNAME or DNAME     resource records that are ordered in specific ways. An     unauthenticated, remote attacker can exploit this, via     responses sent in an unusual order, to cause an     assertion failure, resulting in the resolver     terminating. (CVE-2017-3137)

  - A denial of service vulnerability exists when handling a     NULL command string sent to the named control channel.
    An authenticated, remote attacker can exploit this to     cause an REQUIRE assertion failure, resulting in the     named daemon exiting. Note that the BIND control channel     is not configured by default. (CVE-2017-3138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3259-1 advisory.

    It was discovered that the resolver in Bind made incorrect assumptions about ordering when processing     responses containing a CNAME or DNAME. An attacker could use this cause a denial of service.
    (CVE-2017-3137)

    Oleg Gorokhov discovered that in some situations, Bind did not properly handle DNS64 queries. An attacker     could use this to cause a denial of service. (CVE-2017-3136)

    Mike Lalumiere discovered that in some situations, Bind did not properly handle invalid operations     requested via its control channel. An attacker with access to the control channel could cause a denial of     service. (CVE-2017-3138)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

This update for bind fixes the following security issues:
CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64.
CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528):
When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bind fixes the following issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol. One additional non-security bug was fixed: The default umask was changed to 077. (bsc#1020983)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC reports :

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.

An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met.

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.

A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.

ID	Name	Product	Family	Severity
423693	Alpine: multiple bind packages: security update to 9.11.0_p5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423693	Alpine: multiple bind packages: security update to 9.11.0_p5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403635	Alpine: bind: security update to 9.10.4_p8	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403635	Alpine: bind: security update to 9.10.4_p8	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403633	Alpine: bind: security update to 9.10.4_p8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403633	Alpine: bind: security update to 9.10.4_p8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
102531	GLSA-201708-01 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
101751	Fedora 26 : 32:bind (2017-f9f909a7b7)	Nessus	Fedora Local Security Checks	high
101692	Fedora 26 : bind99 (2017-a354efc764)	Nessus	Fedora Local Security Checks	high
100477	Debian DLA-957-1 : bind9 security update	Nessus	Debian Local Security Checks	high
100167	Debian DSA-3854-1 : bind9 - security update	Nessus	Debian Local Security Checks	high
100014	Fedora 24 : bind99 (2017-edce28f24b)	Nessus	Fedora Local Security Checks	high
99605	Fedora 24 : 32:bind (2017-0a876b0ba5)	Nessus	Fedora Local Security Checks	high
99499	openSUSE Security Update : bind (openSUSE-2017-491)	Nessus	SuSE Local Security Checks	high
99495	Fedora 25 : 32:bind (2017-ee4b0f53cb)	Nessus	Fedora Local Security Checks	high
99488	Fedora 25 : bind99 (2017-44e494db1e)	Nessus	Fedora Local Security Checks	high
99478	ISC BIND 9 < 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1r3 Multiple Vunlerabilities	Nessus	DNS	high
99435	Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerabilities (USN-3259-1)	Nessus	Ubuntu Local Security Checks	high
99378	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : bind (SSA:2017-103-01)	Nessus	Slackware Local Security Checks	high
99358	SUSE SLES11 Security Update : bind (SUSE-SU-2017:1000-1)	Nessus	SuSE Local Security Checks	high
99357	SUSE SLES12 Security Update : bind (SUSE-SU-2017:0999-1)	Nessus	SuSE Local Security Checks	high
99356	SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2017:0998-1)	Nessus	SuSE Local Security Checks	high
99325	FreeBSD : BIND -- multiple vulnerabilities (c6861494-1ffb-11e7-934d-d05099c0ae8c)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-3138

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high