The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to
    a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5,
    9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1. (CVE-2017-3140)

  - The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve
    privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9,
    9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1,
    9.10.5-S1. (CVE-2017-3141)

  - An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge
    of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully
    constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL
    protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or
    accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1,
    9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. (CVE-2017-3142)

  - An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge
    of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into
    accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1,
    9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. (CVE-2017-3143)

The remote host is affected by the vulnerability described in GLSA-201708-01 (BIND: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BIND. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted DNS request to the BIND       resolver resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the instance of ISC BIND running on the remote name server is 9.x.x prior to 9.9.10-P1, 9.10.x prior to 9.10.5-P1, or 9.11.x prior to 9.11.1-P1. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists when processing     Response Policy Zone (RPZ) rule types. An     unauthenticated, remote attacker can exploit this, via a     specially crafted query, to cause an infinite loop     condition that degrades the server's functionality.
    (CVE-2017-3140)

  - A privilege escalation vulnerability exists in the BIND     installer for Windows due to using an unquoted service     path. A local attacker can exploit this to gain elevated     privileges provided that the host file system     permissions allow this. Note that non-Windows builds and     installations are not affected. (CVE-2017-3141)

ID	Name	Product	Family	Severity
403641	Alpine: bind: security update to 9.11.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403641	Alpine: bind: security update to 9.11.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
102531	GLSA-201708-01 : BIND: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
100996	ISC BIND 9.x.x < 9.9.10-P1 / 9.10.x < 9.10.5-P1 / 9.11.x < 9.11.1-P1 Multiple Vulnerabilities	Nessus	DNS	high

Detections

Analytics

CVE-2017-3141

high

Tenable Plugins

high

high

high

high