4.3

CVE-2017-3142

An error in TSIG authentication can permit unauthorized zone transfers

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Isc ≫ Bind Version >= 9.4.0 <= 9.8.8
Isc ≫ Bind Version >= 9.9.0 <= 9.9.10
Isc ≫ Bind Version >= 9.10.0 <= 9.10.5
Isc ≫ Bind Version >= 9.11.0 <= 9.11.1
Isc ≫ Bind Version 9.9.0 Update p1
Isc ≫ Bind Version 9.9.3 Update s1
Isc ≫ Bind Version 9.9.10 Update s2
Isc ≫ Bind Version 9.10.5 Update p1
Isc ≫ Bind Version 9.10.5 Update s1
Isc ≫ Bind Version 9.10.5 Update s2
Isc ≫ Bind Version 9.11.1 Update p1
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.4% 0.918
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.7 2.2 1.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
ISC 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us
Third Party Advisory
http://www.securityfocus.com/bid/99339
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038809
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2017:1679
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1680
Third Party Advisory
https://kb.isc.org/docs/aa-01504
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190830-0003/
https://www.debian.org/security/2017/dsa-3904
Third Party Advisory