CVE-2017-3145
Improper fetch cleanup sequencing in the resolver can cause named to crash
At a glance Severity HIGH 7.5 EPSS EPSS 27.93 % · percentile 98 (2026-10-27) State PUBLISHED Published 2019-01-16 Updated 2024-09-17 Assigner isc NVD status Modified Description BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.
Scores Version Score Vector Scored by CVSS 3.0 HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H isc CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 3.0 HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · security-officer@isc.org (Secondary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.4.0 ≤ 9.8.8cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.9.0 ≤ 9.9.11cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.10.0 ≤ 9.10.6cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.11.0 ≤ 9.11.2cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.9.11:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.5:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.10.6:s1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:alpha1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:b1:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:b2:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.12.0:rc1:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*cpe:2.3:o:juniper:junos:12.1x46-d76:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:12.3x48-d70:-:*:*:*:*:*:*+4 more Affected products Product Versions ISC · BIND 9 affected 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1
References
Sources
