An error in TSIG authentication can permit unauthorized zone transfers
Vulnerability Description
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-3142
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.
References
- https://access.redhat.com/errata/RHSA-2017:1680
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us
- https://access.redhat.com/errata/RHSA-2017:1679
- http://www.securityfocus.com/bid/99339
- http://www.securitytracker.com/id/1038809
- https://www.debian.org/security/2017/dsa-3904
- https://kb.isc.org/docs/aa-01504
- https://security.netapp.com/advisory/ntap-20190830-0003/
More from ISC
View All →Affected Vendor
Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.