CVE-2017-3138 named exits with a REQUIRE assertion failure if it receives a null command string on its control channel
An attacker can cause the BIND DNS server to crash by sending a null command string to its control channel, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-3138?
CVE-2017-3138 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 16 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.
Weakness: CWE-617
Which versions are affected by CVE-2017-3138?
It affects 5 products.
Products include Debian Debian Linux, Isc Bind, Netapp Data Ontap Edge, Netapp Element Software, Netapp Oncommand Balance.
How do I fix CVE-2017-3138?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-3138 being exploited?
There is no known exploitation of CVE-2017-3138 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-3138, DEBIAN-CVE-2017-3138, GHSA-q858-q2j2-9jg4, UBUNTU-CVE-2017-3138.