CVE-2017-3143

An error in TSIG authentication can permit unauthorized dynamic updates

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

Affected

ISC · BIND 9

CVSS v3.0 NVD

5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v3.0 ISC

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

18.30% chance of exploitation in the next 30 days, 97th percentile

Published

2019-01-16

Updated

2024-09-16

Proof-of-concept exploits (1)

• saaph/CVE-2017-31431★ · 2019-07-10

Security advisories

• https://kb.isc.org/docs/aa-01503
• http://www.securityfocus.com/bid/99337
• http://www.securitytracker.com/id/1038809
• https://access.redhat.com/errata/RHSA-2017:1679
• https://access.redhat.com/errata/RHSA-2017:1680
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux0…
• https://www.debian.org/security/2017/dsa-3904

References

• CVE Record
• NVD entry

Related

• CVE-2017-11104