CVE-2017-3142
Description
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isc bind | 9.4.0 ≤ v ≤ 9.8.8, 9.9.0 ≤ v ≤ 9.9.10, 9.10.0 ≤ v ≤ 9.10.5, 9.11.0 ≤ v ≤ 9.11.1, 9.9.0, 9.9.3, 9.9.10, 9.10.5, 9.11.1 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.3, 7.4, 7.6 | — |
| redhat enterprise_linux_server_eus | 7.3, 7.4, 7.5, 7.6 | — |
| redhat enterprise_linux_server_tus | 7.3, 7.6 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.