CVE-2017-3137 A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME
A remote attacker can cause the BIND DNS resolver to crash by sending a response with CNAME or DNAME records in an unusual order.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-3137?
CVE-2017-3137 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 16 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.
Weakness: CWE-617
Which versions are affected by CVE-2017-3137?
It affects 11 products.
Linux distribution packages (9)
bind SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Linux Enterprise Server 11 SP3-LTSS | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Linux Enterprise Server 11 SP4 | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Manager 2.1 | All versions | 9.9.6P1-0.47.1 |
bind SUSE:Manager Proxy 2.1 | All versions | 9.9.6P1-0.47.1 |
bind SUSE:OpenStack Cloud 5 | All versions | 9.9.6P1-0.47.1 |
Products include Debian Debian Linux, Isc Bind, Netapp Data Ontap Edge, Netapp Element Software, Netapp Oncommand Balance, Redhat Enterprise Linux Desktop and 5 more.
How do I fix CVE-2017-3137?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-3137 being exploited?
There is no known exploitation of CVE-2017-3137 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-3137, DEBIAN-CVE-2017-3137, GHSA-wmp5-3j44-5x2x, SUSE-SU-2017:1027-1, UBUNTU-CVE-2017-3137.