CVE-2017-3145

CWE-416Use After Free10 documents8 sources
Severity
7.5HIGH
EPSS
8.0%
top 7.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 16
Latest updateMay 13

Description

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

Debianbind9< 1:9.11.2.P1-1+3
NVDisc/bind9.4.09.8.8+8
CVEListV5isc/bind_99.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1
NVDjuniper/junos6 versions+5

Also affects: Debian Linux 7.0, 8.0, 9.0, Enterprise Linux 6.4, 6.5, 6.6, 7.2, 7.3, 7.4, 7.6, 6.7, 7.5

🔴Vulnerability Details

3
GHSA
GHSA-3hx4-77f4-g7cp: BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigg2022-05-13
OSV
CVE-2017-3145: BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigg2019-01-16
CVEList
Improper fetch cleanup sequencing in the resolver can cause named to crash2019-01-16

📋Vendor Advisories

4
Ubuntu
Bind vulnerability2018-01-17
Ubuntu
Bind vulnerability2018-01-17
Red Hat
bind: Improper fetch cleanup sequencing in the resolver can cause named to crash2018-01-16
Debian
CVE-2017-3145: bind9 - BIND was improperly sequencing cleanup operations on upstream recursion fetch co...2017

💬Community

2
Bugzilla
CVE-2017-3145 bind: Improper sequencing during cleanup can lead to use-after-free error, causinga crash in named [fedora-all]2018-01-17
Bugzilla
CVE-2017-3145 bind: Improper fetch cleanup sequencing in the resolver can cause named to crash2018-01-16
CVE-2017-3145 (HIGH CVSS 7.5) | BIND was improperly sequencing clea | cvebase.io