CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers
First published: Thu Jun 29 2017(Updated: )
An attacker able to send and receive messages to an authoritative DNS server may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: * providing an AXFR of a zone to an unauthorized recipient * accepting bogus Notify packets An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone. Protection of zone contents is often a commercial or business requirement. If accepted, a Notify sets the zone refresh interval to 'now'. If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters. If there is already a refresh cycle in progress, then named will queue the new refresh request. If there is already a queued refresh request, the new Notify will be discarded. Bogus notifications can't be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles. Workarounds: The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in parallel. For information on how to configure this type of compound authentication control, please see: <a href="https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html">https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html</a>. (Note that this technique will not be effective against bogus Notify packets if an attacker is able to reach the target DNS server whilst using a spoofed sending address). Upstream patch: <a href="https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab">https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab</a>
Credit: security-officer@isc.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/bind9 | 1:9.11.5.P4+dfsg-5.1+deb10u7 1:9.11.5.P4+dfsg-5.1+deb10u9 1:9.16.44-1~deb11u1 1:9.18.19-1~deb12u1 1:9.19.17-1 | |
| ISC BIND | >=9.4.0<=9.8.8 | |
| ISC BIND | >=9.9.0<=9.9.10 | |
| ISC BIND | >=9.10.0<=9.10.5 | |
| ISC BIND | >=9.11.0<=9.11.1 | |
| ISC BIND | =9.9.0-p1 | |
| ISC BIND | =9.9.3-s1 | |
| ISC BIND | =9.9.10-s2 | |
| ISC BIND | =9.10.5-p1 | |
| ISC BIND | =9.10.5-s1 | |
| ISC BIND | =9.10.5-s2 | |
| ISC BIND | =9.11.1-p1 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Server Aus | =7.3 | |
| Redhat Enterprise Linux Server Aus | =7.4 | |
| Redhat Enterprise Linux Server Aus | =7.6 | |
| Redhat Enterprise Linux Server Eus | =7.3 | |
| Redhat Enterprise Linux Server Eus | =7.4 | |
| Redhat Enterprise Linux Server Eus | =7.5 | |
| Redhat Enterprise Linux Server Eus | =7.6 | |
| Redhat Enterprise Linux Server Tus | =7.3 | |
| Redhat Enterprise Linux Server Tus | =7.6 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Redhat Enterprise Linux Workstation | =7.0 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| redhat/bind | <9.9.10 | 9.9.10 |
| redhat/bind | <9.10.5 | 9.10.5 |
| redhat/bind | <9.11.1 | 9.11.1 |
Remedy
Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads. BIND 9 version 9.9.10-P2 BIND 9 version 9.10.5-P2 BIND 9 version 9.11.1-P2 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9 version 9.9.10-S3 BIND 9 version 9.10.5-S3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2017-3142
- https://security-tracker.debian.org/tracker/CVE-2017-3143
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3142
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143
- https://kb.isc.org/article/AA-01504
- https://kb.isc.org/article/AA-01503
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866564
- http://www.securityfocus.com/bid/99339
- http://www.securitytracker.com/id/1038809
- https://access.redhat.com/errata/RHSA-2017:1679
- https://access.redhat.com/errata/RHSA-2017:1680
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us
- https://kb.isc.org/docs/aa-01504
- https://security.netapp.com/advisory/ntap-20190830-0003/
- https://www.debian.org/security/2017/dsa-3904
- https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html
- https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1466611
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1466612
- https://bugzilla.redhat.com/show_bug.cgi?id=1466189
- https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab0f74a177980da9ff0514f795ed8669
- collector/debian-bugs
- alias/CVE-2017-3142
- collector/security-tracker-debian
- collector/nvd-index
- agent/softwarecombine
- agent/type
- agent/author
- agent/weakness
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/remedy
- agent/first-publish-date
- agent/tags
- agent/event
- package-manager/debian
- vendor/isc
- canonical/isc bind
- version/isc bind/9.4.0
- version/isc bind/9.8.8
- version/isc bind/9.9.0
- version/isc bind/9.9.10
- version/isc bind/9.10.0
- version/isc bind/9.10.5
- version/isc bind/9.11.0
- version/isc bind/9.11.1
- version/isc bind/9.9.0-p1
- version/isc bind/9.9.3-s1
- version/isc bind/9.9.10-s2
- version/isc bind/9.10.5-p1
- version/isc bind/9.10.5-s1
- version/isc bind/9.10.5-s2
- version/isc bind/9.11.1-p1
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/7.3
- version/redhat enterprise linux server aus/7.4
- version/redhat enterprise linux server aus/7.6
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/7.3
- version/redhat enterprise linux server eus/7.4
- version/redhat enterprise linux server eus/7.5
- version/redhat enterprise linux server eus/7.6
- canonical/redhat enterprise linux server tus
- version/redhat enterprise linux server tus/7.3
- version/redhat enterprise linux server tus/7.6
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- package-manager/redhat