CVE-2017-3139 Denial of service in BIND

High 7.5 Published 9 Apr 2019 Updated 5 Aug 2024

Remote attackers can crash the BIND DNS server by sending specially crafted DNS responses during DNSSEC validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-3139?

CVE-2017-3139 is a high-severity denial of service vulnerability in Redhat Enterprise Linux Server Aus, published on 9 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.

Weakness: CWE-617

Which versions are affected by CVE-2017-3139?

It affects 3 products.

Linux distribution packages (28)

`bind` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-chroot` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-devel` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-libs` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-sdb` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-utils` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-chroot` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-devel` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-libs` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-sdb` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-utils` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-chroot` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-devel` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-libs` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-sdb` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-utils` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-chroot` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-devel` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-libs` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-sdb` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`
`bind-utils` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.62.rc1.el6_9.2`

Products include Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Server Tus.

How do I fix CVE-2017-3139?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-3139 being exploited?

There is no known exploitation of CVE-2017-3139 in the wild and no public exploit code.

Sources

Also known as GHSA-qr8v-h24f-rg77, RHSA-2017:1202.