Medium severity · published Jan 16, 2019
CVE-2017-3135
Combination of DNS64 and RPZ Can Lead to Crash
5.9
CVSS
17.2%
EPSS
No
On KEV
Description
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)17.2% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
B9
BIND 9 · ISC
BIND 9 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1 · source: vendor
BI
Bind · Isc
9.9.3; 9.9.3; 9.9.8; 9.9.9; 9.9.9; 9.9.10; +11 more · source: NVD
DO
Data Ontap Edge · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
ES
Element Software Management Node · Netapp
All versions, or not specified · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.3; 7.4; 7.6 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.3; 7.4; 7.5; 7.6 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.3; 7.6 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3135
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3135
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0276.html
Third Party Advisory
http://www.securityfocus.com/bid/96150
Third Party Advisory
http://www.securitytracker.com/id/1037801
Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_us
Vendor Advisory
https://kb.isc.org/docs/aa-01453
Third Party Advisory
https://security.gentoo.org/glsa/201708-01
More from BIND 9
9.8
CVE-2026-3593
Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
8.6
CVE-2026-13321
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
8.1
CVE-2026-94300
Concurrent GSS-TSIG messages corrupt memory
7.8
CVE-2017-3141
Windows service and uninstall paths are not quoted when BIND is installed
7.5
CVE-2026-97313
Specific RPZ configurations and query patterns may result in an unexpected exit