5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.191 Low
EPSS
Percentile
96.3%
According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.9.x prior to 9.9.9-P8 or 9.9.9-S10, 9.10.x prior to 9.10.4-P8, or 9.11.x prior to 9.11.0-P5. It is, therefore, affected by multiple vulnerabilities :
A denial of service vulnerability exists in DNS64 when handling certain queries for synthesized records. An unauthenticated, remote attacker can exploit this, via a specially crafted query, to cause an assertion failure, resulting in DNS64 terminating. Note that issue applies if the server is configured to use DNS64 and if the option ‘break-dnssec yes;’ is in use. (CVE-2017-3136)
A denial of service vulnerability exists when handling specially crafted responses containing CNAME or DNAME resource records that are ordered in specific ways. An unauthenticated, remote attacker can exploit this, via responses sent in an unusual order, to cause an assertion failure, resulting in the resolver terminating. (CVE-2017-3137)
A denial of service vulnerability exists when handling a NULL command string sent to the named control channel.
An authenticated, remote attacker can exploit this to cause an REQUIRE assertion failure, resulting in the named daemon exiting. Note that the BIND control channel is not configured by default. (CVE-2017-3138)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(99478);
script_version("1.7");
script_cvs_date("Date: 2019/11/13");
script_cve_id("CVE-2017-3136", "CVE-2017-3137", "CVE-2017-3138");
script_bugtraq_id(97651, 97653, 97657);
script_name(english:"ISC BIND 9 < 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1r3 Multiple Vunlerabilities");
script_summary(english:"Checks the version of BIND.");
script_set_attribute(attribute:"synopsis", value:
"The remote name server is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of ISC BIND 9
running on the remote name server is 9.9.x prior to 9.9.9-P8 or
9.9.9-S10, 9.10.x prior to 9.10.4-P8, or 9.11.x prior to 9.11.0-P5. It
is, therefore, affected by multiple vulnerabilities :
- A denial of service vulnerability exists in DNS64 when
handling certain queries for synthesized records. An
unauthenticated, remote attacker can exploit this, via a
specially crafted query, to cause an assertion failure,
resulting in DNS64 terminating. Note that issue applies
if the server is configured to use DNS64 and if the
option 'break-dnssec yes;' is in use. (CVE-2017-3136)
- A denial of service vulnerability exists when handling
specially crafted responses containing CNAME or DNAME
resource records that are ordered in specific ways. An
unauthenticated, remote attacker can exploit this, via
responses sent in an unusual order, to cause an
assertion failure, resulting in the resolver
terminating. (CVE-2017-3137)
- A denial of service vulnerability exists when handling a
NULL command string sent to the named control channel.
An authenticated, remote attacker can exploit this to
cause an REQUIRE assertion failure, resulting in the
named daemon exiting. Note that the BIND control channel
is not configured by default. (CVE-2017-3138)
Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/article/AA-01465");
script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/article/AA-01466");
script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/article/AA-01471");
script_set_attribute(attribute:"solution", value:
"Upgrade to ISC BIND version 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 /
9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1rc3 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-3137");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/12");
script_set_attribute(attribute:"patch_publication_date", value:"2017/04/12");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/19");
script_set_attribute(attribute:"potential_vulnerability", value:"true");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:isc:bind");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"DNS");
script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("bind_version.nasl");
script_require_keys("bind/version", "Settings/ParanoidReport");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
ver = get_kb_item_or_exit("bind/version");
if (report_paranoia < 2) audit(AUDIT_PARANOID);
if (
# 9.9.0 - 9.9.8
ver =~ "^9\.9\.[0-8]($|[^0-9])" ||
# 9.9.9 <= 9.9.9-P7/9.9.9-S9
ver =~ "^9\.9\.9((([ab]|beta|rc)[0-9]*)|(-P[0-7])|(-S[0-9]))?$" ||
# 9.10.0 - 9.10.3
ver =~ "^9\.10\.[0-3]($|[^0-9])" ||
# 9.10.4 <= 9.10.4-P7
ver =~ "^9\.10\.4((([ab]|beta|rc)[0-9]*)|(-P[0-7]))?$" ||
# 9.11.0.x <= 9.11.0-P4
ver =~ "^9\.11\.0((([ab]|beta|rc)[0-9]*)|(-P[0-4]))?$" ||
# beta and RC versions
# 9.9.10b1 - 9.9.10rc2
ver =~ "^9\.9\.10(b|beta)([0-9]*)?$" ||
ver =~ "^9\.9\.10rc[0-2]?$" ||
# 9.10.5b1 - 9.10.5rc2
ver =~ "^9\.10\.5(b|beta)([0-9]*)?$" ||
ver =~ "^9\.10\.5rc[0-2]?$" ||
# 9.11.1b1 - 9.11.1rc2
ver =~ "^9\.11\.1((b|beta)[0-9])?$" ||
ver =~ "^9\.11\.1rc[0-2]?$"
)
{
items = make_array(
"Installed version", ver,
"Fixed version", "9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1rc3"
);
order = make_list("Installed version", "Fixed version");
security_report_v4(
severity:SECURITY_WARNING,
port:53,
proto:"udp",
extra:report_items_str(
report_items:items,
ordered_fields:order
)
);
}
else audit(AUDIT_LISTEN_NOT_VULN, "BIND", 53, ver, "UDP");
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.191 Low
EPSS
Percentile
96.3%