CVE-2017-3140 An error processing RPZ rules can cause named to loop endlessly after handling a query
Attackers can cause a denial of service in BIND DNS servers by triggering an infinite loop during Response Policy Zone processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-3140?
CVE-2017-3140 is a low-severity denial of service vulnerability in Isc Bind, published on 16 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.
Weakness: CWE-400
Which versions are affected by CVE-2017-3140?
It affects 4 products.
Products include Isc Bind, Netapp Data Ontap Edge, Netapp Element Software, Netapp Oncommand Balance.
How do I fix CVE-2017-3140?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-3140 being exploited?
There is no known exploitation of CVE-2017-3140 in the wild and no public exploit code.
Other vulnerabilities in Isc Bind
Sources
Also known as ALPINE-CVE-2017-3140, GHSA-6f7c-h629-3xqv.