7.5

CVE-2017-3143

An error in TSIG authentication can permit unauthorized dynamic updates

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Isc ≫ Bind Version >= 9.4.0 <= 9.8.8
Isc ≫ Bind Version >= 9.9.0 <= 9.9.10
Isc ≫ Bind Version >= 9.10.0 <= 9.10.5
Isc ≫ Bind Version >= 9.11.0 <= 9.11.1
Isc ≫ Bind Version9.9.0 Updatep1
Isc ≫ Bind Version9.9.3 Updates1
Isc ≫ Bind Version9.9.10 Updates2
Isc ≫ Bind Version9.10.5 Updatep1
Isc ≫ Bind Version9.10.5 Updates1
Isc ≫ Bind Version9.10.5 Updates2
Isc ≫ Bind Version9.11.1 Updatep1
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 26.93% 0.963
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
security-officer@isc.org 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.securitytracker.com/id/1038809
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/99337
Third Party Advisory
VDB Entry