CVE-2017-3138

NameCVE-2017-3138
Descriptionnamed exits with a REQUIRE assertion failure if it receives a null command string on its control channel
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-957-1, DSA-3854-1
Debian Bugs860226

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)wheezy1:9.8.4.dfsg.P1-6+nmu2+deb7u10vulnerable
wheezy (security)1:9.8.4.dfsg.P1-6+nmu2+deb7u18fixed
jessie1:9.9.5.dfsg-9+deb8u12fixed
jessie (security)1:9.9.5.dfsg-9+deb8u13fixed
stretch1:9.10.3.dfsg.P4-12.3+deb9u3fixed
stretch (security)1:9.10.3.dfsg.P4-12.3+deb9u2fixed
buster1:9.10.3.dfsg.P4-12.6fixed
sid1:9.10.6+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bind9source(unstable)1:9.10.3.dfsg.P4-12.3860226
bind9sourcejessie1:9.9.5.dfsg-9+deb8u11DSA-3854-1
bind9sourcewheezy1:9.8.4.dfsg.P1-6+nmu2+deb7u16DLA-957-1

Notes

https://kb.isc.org/article/AA-01471
Fixed by (9.10.x): https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=a636604b20cc0aaabc8edbb7595f7c1c820b7610
In practice for any Debian version applying this commit is merely
hardening, since the feature to allow only a subset of "read only"
commands was added only in 9.11.0 and before existing commands permitted
over the control channel were already be given to cause the server to stop.
The CVE-2017-3138 is barely an issue in practice anyway.

Search for package or bug name: Reporting problems