Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2017-3141

Windows service and uninstall paths are not quoted when BIND is installed

At a glance

Severity
HIGH 7.2
EPSS
EPSS 1.43 % · percentile 73 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
isc
NVD status
Modified

Description

The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.

Scores

VersionScoreVectorScored by
CVSS 3.0HIGH 7.2CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:Hisc
CVSS 3.0HIGH 7.2CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HNVD · security-officer@isc.org (Secondary)
CVSS 3.0HIGH 7.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 2.0HIGH 7.2AV:L/AC:L/Au:N/C:C/I:C/A:CNVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
ISC · BIND 9affected 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD