Descriptionnamed exits with a REQUIRE assertion failure if it receives a null command string on its control channel
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-957-1, DSA-3854-1
Debian Bugs860226

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)wheezy1:9.8.4.dfsg.P1-6+nmu2+deb7u10vulnerable
wheezy (security)1:9.8.4.dfsg.P1-6+nmu2+deb7u16fixed
jessie (security)1:9.9.5.dfsg-9+deb8u11fixed
buster, sid, stretch1:9.10.3.dfsg.P4-12.3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

Fixed by (9.10.x):;a=commitdiff;h=a636604b20cc0aaabc8edbb7595f7c1c820b7610
In practice for any Debian version applying this commit is merely
hardening, since the feature to allow only a subset of "read only"
commands was added only in 9.11.0 and before existing commands permitted
over the control channel were already be given to cause the server to stop.
The CVE-2017-3138 is barely an issue in practice anyway.

Search for package or bug name: Reporting problems