CVE-2017-3145

EPSS 27.93%
Veröffentlicht 16.01.2019 20:29:00
Zuletzt bearbeitet 21.11.2024 03:24:55
Erkennungen
Login

Improper fetch cleanup sequencing in the resolver can cause named to crash

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 14

NVD 44 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Isc ≫ Bind Version >= 9.4.0 <= 9.8.8

Isc ≫ Bind Version >= 9.9.0 <= 9.9.11

Isc ≫ Bind Version >= 9.10.0 <= 9.10.6

Isc ≫ Bind Version >= 9.11.0 <= 9.11.2

Isc ≫ Bind Version 9.9.3 Update s1

Isc ≫ Bind Version 9.9.11 Update s1

Isc ≫ Bind Version 9.10.5 Update s1

Isc ≫ Bind Version 9.10.6 Update s1

Isc ≫ Bind Version 9.12.0 Update alpha1

Isc ≫ Bind Version 9.12.0 Update b1

Isc ≫ Bind Version 9.12.0 Update b2

Isc ≫ Bind Version 9.12.0 Update rc1

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 6.4

Redhat ≫ Enterprise Linux Server Aus Version 6.5

Redhat ≫ Enterprise Linux Server Aus Version 6.6

Redhat ≫ Enterprise Linux Server Aus Version 7.2

Redhat ≫ Enterprise Linux Server Aus Version 7.3

Redhat ≫ Enterprise Linux Server Aus Version 7.4

Redhat ≫ Enterprise Linux Server Aus Version 7.6

Redhat ≫ Enterprise Linux Server Eus Version 6.7

Redhat ≫ Enterprise Linux Server Eus Version 7.3

Redhat ≫ Enterprise Linux Server Eus Version 7.4

Redhat ≫ Enterprise Linux Server Eus Version 7.5

Redhat ≫ Enterprise Linux Server Eus Version 7.6

Redhat ≫ Enterprise Linux Server Tus Version 6.6

Redhat ≫ Enterprise Linux Server Tus Version 7.2

Redhat ≫ Enterprise Linux Server Tus Version 7.3

Redhat ≫ Enterprise Linux Server Tus Version 7.6

Redhat ≫ Enterprise Linux Workstation Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 7.0

Debian ≫ Debian Linux Version 7.0

Debian ≫ Debian Linux Version 8.0

Debian ≫ Debian Linux Version 9.0

Netapp ≫ Data Ontap Edge Version -

Juniper ≫ Junos Version 12.1x46-d76 Update -

   Juniper ≫ Srx100 Version -
   Juniper ≫ Srx110 Version -
   Juniper ≫ Srx1400 Version -
   Juniper ≫ Srx1500 Version -
   Juniper ≫ Srx210 Version -
   Juniper ≫ Srx220 Version -
   Juniper ≫ Srx240 Version -
   Juniper ≫ Srx240h2 Version -
   Juniper ≫ Srx240m Version -
   Juniper ≫ Srx300 Version -
   Juniper ≫ Srx320 Version -
   Juniper ≫ Srx340 Version -
   Juniper ≫ Srx3400 Version -
   Juniper ≫ Srx345 Version -
   Juniper ≫ Srx3600 Version -
   Juniper ≫ Srx380 Version -
   Juniper ≫ Srx4000 Version -
   Juniper ≫ Srx4100 Version -
   Juniper ≫ Srx4200 Version -
   Juniper ≫ Srx4600 Version -
   Juniper ≫ Srx5000 Version -
   Juniper ≫ Srx5400 Version -
   Juniper ≫ Srx550 Version -
   Juniper ≫ Srx550 Hm Version -
   Juniper ≫ Srx550m Version -
   Juniper ≫ Srx5600 Version -
   Juniper ≫ Srx5800 Version -
   Juniper ≫ Srx650 Version -

Juniper ≫ Junos Version 12.3x48-d70 Update -

Juniper ≫ Junos Version 15.1x49-d140 Update -

Juniper ≫ Junos Version 17.4r2 Update -

Juniper ≫ Junos Version 18.1r2 Update -

Juniper ≫ Junos Version 18.2r1 Update -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	27.93%	0.979

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P
ISC	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.securitytracker.com/id/1040195

Third Party Advisory

Broken Link

VDB Entry

http://www.securityfocus.com/bid/102716

Third Party Advisory

Broken Link

VDB Entry

https://access.redhat.com/errata/RHSA-2018:0101

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0102

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0487

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0488

Third Party Advisory

https://kb.isc.org/docs/aa-01542

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2018/01/msg00029.html

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20180117-0003/

Third Party Advisory

https://supportportal.juniper.net/s/article/2018-07-Security-Bulletin-SRX-Series-Vulnerabilities-in-ISC-BIND-named

Third Party Advisory

https://www.debian.org/security/2018/dsa-4089

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2017-3145

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-3145

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-3145

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2017-3145