oss-sec mailing list archives
New vulnerability in ISC BIND announced (CVE-2017-3145)
From: ISC Security Officer <security-officer () isc org>
Date: Tue, 16 Jan 2018 15:25:46 -0600
Please be advised that ISC public announced a vulnerability in ISC BIND. CVE-2017-3145 is a denial-of-service vector which can potentially be exploited against ISC BIND servers, causing them to crash. The underlying flaw has existed since BIND 9.0.0 but is not known to be reachable in any version prior to those containing the fix for CVE-2017-3137 [9.9.9-P8 to 9.9.11, 9.10.4-P8 to 9.10.6, 9.11.0-P5 to 9.11.2, 9.9.9-S10 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, and 9.12.0a1 to 9.12.0rc1], and then only when acting as DNSSEC validating resolvers. Our full CVE text can be found at https://kb.isc.org/article/AA-01542 New releases of ISC BIND, including security fixes for this vulnerability, are available at: https://www.isc.org/downloads/ Release notes can be obtained using the following links: ftp://ftp.isc.org/isc/bind9/9.9.11-P1/RELEASE-NOTES-bind-9.9.11-P1.txt ftp://ftp.isc.org/isc/bind9/9.10.6-P1/RELEASE-NOTES-bind-9.10.6-P1.txt ftp://ftp.isc.org/isc/bind9/9.11.2-P1/RELEASE-NOTES-bind-9.11.2-P1.txt ftp://ftp.isc.org/isc/bind9/9.12.0rc3/RELEASE-NOTES-bind-9.12.0rc3.txt -- Brian Conry ISC Support Acting Security Officer
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- New vulnerability in ISC BIND announced (CVE-2017-3145) ISC Security Officer (Jan 16)