CVE-2017-3140: An error processing RPZ rules can cause named to loop endlessly after handling a query

Medium severity · published Jan 16, 2019

CVE-2017-3140

An error processing RPZ rules can cause named to loop endlessly after handling a query

5.9

CVSS

12.2%

EPSS

On KEV

Description

If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)12.2% · higher than 96% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BIND 9 · ISC

9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1 · source: vendor

Bind · Isc

9.11.0 through 9.11.1; 9.9.10; 9.9.10; 9.10.5; 9.10.5 · source: NVD

Data Ontap Edge · Netapp

All versions, or not specified · source: NVD

Element Software · Netapp

All versions, or not specified · source: NVD

Oncommand Balance · Netapp

All versions, or not specified · source: NVD

Affected product

BIND 9

ISC

All BIND 9 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-3140

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-3140

Third Party Advisory

http://www.securityfocus.com/bid/99088

Third Party Advisory

http://www.securitytracker.com/id/1038692

Third Party Advisory

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us

Vendor Advisory

https://kb.isc.org/docs/aa-01495

Third Party Advisory

https://security.gentoo.org/glsa/201708-01

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180926-0001/