CVE-2017-3136
An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"
- Published
- Updated
- Reserved
- Assigned by
- isc
Description
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| iscCNA (assigner) | 3.0 | Medium5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.0 | Medium5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 11.1% · top 4.1% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
- Servers are at risk if they are configured to use DNS64 and if the option "break-dnssec yes;" is in use.
- CWE-617 (opens in a new tab)
Affected products
ISC · BIND 9
- affected 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8
What to do
Solution: Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads. BIND 9 version 9.9.9-P8 BIND 9 version 9.10.4-P8 BIND 9 version 9.11.0-P5 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9 version 9.9.9-S10 New maintenance releases of BIND are also scheduled which contain the fix for this vulnerability. In addition to the security releases listed above, fixes for this vulnerability are also included in these release candidate versions: BIND 9 version 9.9.10rc3 BIND 9 version 9.10.5rc3 BIND 9 version 9.11.1rc3
Workaround: Servers which have configurations which require DNS64 and "break-dnssec yes;" should upgrade. Servers which are not using these features in conjunction are not at risk from this defect.
References (11)
- RHSA-2017:1095 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- GLSA-201708-01 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- https://security.netapp.com/advisory/ntap-20180802-0002/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_us (opens in a new tab)x_refsource_CONFIRMx_transferred
- DSA-3854 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- 1038259 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- 97653 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- RHSA-2017:1105 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- https://kb.isc.org/docs/aa-01465 (opens in a new tab)x_refsource_CONFIRMx_transferred
- openSUSE-SU-2020:1699 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- openSUSE-SU-2020:1701 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .