CVE-2017-3145

EPSS 5.77%
Published 16.01.2019 20:29:00
Last modified 21.11.2024 03:24:55
Source security-officer@isc.org
Teams watchlist Login
Open Login

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

Affected products Warnungen 0 Metrics 4 CWE 1 References 14

Data is provided by the National Vulnerability Database (NVD)

Isc ≫ Bind Version >= 9.4.0 <= 9.8.8

Isc ≫ Bind Version >= 9.9.0 <= 9.9.11

Isc ≫ Bind Version >= 9.10.0 <= 9.10.6

Isc ≫ Bind Version >= 9.11.0 <= 9.11.2

Isc ≫ Bind Version9.9.3 Updates1

Isc ≫ Bind Version9.9.11 Updates1

Isc ≫ Bind Version9.10.5 Updates1

Isc ≫ Bind Version9.10.6 Updates1

Isc ≫ Bind Version9.12.0 Updatealpha1

Isc ≫ Bind Version9.12.0 Updateb1

Isc ≫ Bind Version9.12.0 Updateb2

Isc ≫ Bind Version9.12.0 Updaterc1

Redhat ≫ Enterprise Linux Desktop Version6.0

Redhat ≫ Enterprise Linux Desktop Version7.0

Redhat ≫ Enterprise Linux Server Version6.0

Redhat ≫ Enterprise Linux Server Version7.0

Redhat ≫ Enterprise Linux Server Aus Version6.4

Redhat ≫ Enterprise Linux Server Aus Version6.5

Redhat ≫ Enterprise Linux Server Aus Version6.6

Redhat ≫ Enterprise Linux Server Aus Version7.2

Redhat ≫ Enterprise Linux Server Aus Version7.3

Redhat ≫ Enterprise Linux Server Aus Version7.4

Redhat ≫ Enterprise Linux Server Aus Version7.6

Redhat ≫ Enterprise Linux Server Eus Version6.7

Redhat ≫ Enterprise Linux Server Eus Version7.3

Redhat ≫ Enterprise Linux Server Eus Version7.4

Redhat ≫ Enterprise Linux Server Eus Version7.5

Redhat ≫ Enterprise Linux Server Eus Version7.6

Redhat ≫ Enterprise Linux Server Tus Version6.6

Redhat ≫ Enterprise Linux Server Tus Version7.2

Redhat ≫ Enterprise Linux Server Tus Version7.3

Redhat ≫ Enterprise Linux Server Tus Version7.6

Redhat ≫ Enterprise Linux Workstation Version6.0

Redhat ≫ Enterprise Linux Workstation Version7.0

Debian ≫ Debian Linux Version7.0

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Netapp ≫ Data Ontap Edge Version-

Juniper ≫ Junos Version12.1x46-d76 Update-

   Juniper ≫ Srx100 Version-
   Juniper ≫ Srx110 Version-
   Juniper ≫ Srx1400 Version-
   Juniper ≫ Srx1500 Version-
   Juniper ≫ Srx210 Version-
   Juniper ≫ Srx220 Version-
   Juniper ≫ Srx240 Version-
   Juniper ≫ Srx240h2 Version-
   Juniper ≫ Srx240m Version-
   Juniper ≫ Srx300 Version-
   Juniper ≫ Srx320 Version-
   Juniper ≫ Srx340 Version-
   Juniper ≫ Srx3400 Version-
   Juniper ≫ Srx345 Version-
   Juniper ≫ Srx3600 Version-
   Juniper ≫ Srx380 Version-
   Juniper ≫ Srx4000 Version-
   Juniper ≫ Srx4100 Version-
   Juniper ≫ Srx4200 Version-
   Juniper ≫ Srx4600 Version-
   Juniper ≫ Srx5000 Version-
   Juniper ≫ Srx5400 Version-
   Juniper ≫ Srx550 Version-
   Juniper ≫ Srx550 Hm Version-
   Juniper ≫ Srx550m Version-
   Juniper ≫ Srx5600 Version-
   Juniper ≫ Srx5800 Version-
   Juniper ≫ Srx650 Version-

Juniper ≫ Junos Version12.3x48-d70 Update-

Juniper ≫ Junos Version15.1x49-d140 Update-

Juniper ≫ Junos Version17.4r2 Update-

Juniper ≫ Junos Version18.1r2 Update-

Juniper ≫ Junos Version18.2r1 Update-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	5.77%	0.901

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P
security-officer@isc.org	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.securitytracker.com/id/1040195

Third Party Advisory

Broken Link

VDB Entry

http://www.securityfocus.com/bid/102716

Third Party Advisory

Broken Link

VDB Entry

https://access.redhat.com/errata/RHSA-2018:0101

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0102

Third Party Advisory