CVE-2017-3143
An error in TSIG authentication can permit unauthorized dynamic updates
At a glance Severity HIGH 7.5 EPSS EPSS 18.30 % · percentile 97 (2026-10-27) State PUBLISHED Published 2019-01-16 Updated 2024-09-16 Assigner isc NVD status Modified Description An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Scores Version Score Vector Scored by CVSS 3.0 HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N isc CVSS 3.0 HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD · security-officer@isc.org (Secondary) CVSS 3.0 MEDIUM 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N NVD · nvd@nist.gov (Primary)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.4.0 ≤ 9.8.8cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.9.0 ≤ 9.9.10cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.10.0 ≤ 9.10.5cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.11.0 ≤ 9.11.1cpe:2.3:a:isc:bind:9.9.0:p1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.9.10:s2:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.5:p1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.5:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.5:s2:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.11.1:p1:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*Affected products Product Versions ISC · BIND 9 affected 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2
References
Sources
