CVE-2017-3136

Description

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.

How to fix CVE-2017-3136

To remediate CVE-2017-3136, upgrade the affected package to a fixed version below.

• —upgrade to 9.11.0_p5-r0 or later
• —upgrade to 1:9.10.3.dfsg.P4-12.3 or later
• —upgrade to 1:9.8.4.dfsg.P1-6+nmu2+deb7u16 or later
• —upgrade to 1:9.9.5.dfsg-9+deb8u11 or later

Is CVE-2017-3136 being exploited?

Moderate — EPSS is 48.5%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

• from 0, < 9.11.0_p5-r0
• from 0, < 1:9.10.3.dfsg.P4-12.3
• from 0, < 1:9.8.4.dfsg.P1-6+nmu2+deb7u16
• from 0, < 1:9.9.5.dfsg-9+deb8u11

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-3136
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-3136