Medium severity · published Jan 16, 2019
CVE-2017-3136
An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"
5.9
CVSS
11.2%
EPSS
No
On KEV
Description
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
B9
BIND 9 · ISC
9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8 · source: vendor
BI
Bind · Isc
9.8.0 through 9.8.8; 9.9.0 through 9.9.9; 9.10.0 through 9.10.4; 9.8.0; 9.9.0; 9.9.0; +22 more · source: NVD
DO
Data Ontap Edge · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
8.0 · source: NVD
ES
Element Software · Netapp
All versions, or not specified · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.3; 7.4; 7.6 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.3; 7.4; 7.5; 7.6 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.3; 7.6 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0; 7.0 · source: NVD
OB
Oncommand Balance · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3136
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
Third Party Advisory
http://www.securityfocus.com/bid/97653
Third Party Advisory
http://www.securitytracker.com/id/1038259
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1095
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1105
More from BIND 9
9.8
CVE-2026-3593
Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
8.6
CVE-2026-13321
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
8.1
CVE-2026-94300
Concurrent GSS-TSIG messages corrupt memory
7.8
CVE-2017-3141
Windows service and uninstall paths are not quoted when BIND is installed
7.5
CVE-2026-97313
Specific RPZ configurations and query patterns may result in an unexpected exit