Descriptionnamed exits with a REQUIRE assertion failure if it receives a null command string on its control channel
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-957-1, DSA-3854-1
Debian Bugs860226

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)jessie, jessie (security)1:9.9.5.dfsg-9+deb8u15fixed
stretch, stretch (security)1:9.10.3.dfsg.P4-12.3+deb9u4fixed
buster, sid1:9.11.4+dfsg-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

Fixed by (9.10.x):;a=commitdiff;h=a636604b20cc0aaabc8edbb7595f7c1c820b7610
In practice for any Debian version applying this commit is merely
hardening, since the feature to allow only a subset of "read only"
commands was added only in 9.11.0 and before existing commands permitted
over the control channel were already be given to cause the server to stop.
The CVE-2017-3138 is barely an issue in practice anyway.

Search for package or bug name: Reporting problems