Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2017-3135: BIND may crash when using address translation and domain filters
CVE-2017-3135 · published 7 years ago
Summary
The BIND DNS server, in several recent versions, can experience a software error when both address‑translation (DNS64) and domain‑filtering (RPZ) features are used together. That error can cause the server to stop working or crash, interrupting name‑resolution for your network. Update BIND to a version that includes the fix, or disable one of those features until you can apply the update.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| isc | bind |
9.9.3 9.9.8 9.9.9 9.9.10 9.10.0 9.10.4 9.10.5 9.11.0 9.11.1 cpe:2.3:a:isc:bind:9.9.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
7.0 cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
7.3 7.4 7.6 cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_eus |
7.3 7.4 7.5 7.6 cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus |
7.3 7.6 cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
| netapp | data_ontap_edge |
All versions
cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:* |
| netapp | element_software_management_node |
All versions
cpe:2.3:a:netapp:element_software_management_node:-:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to r...
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.
References
- http://rhn.redhat.com/errata/RHSA-2017-0276.html Third Party Advisory
- http://www.securityfocus.com/bid/96150 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037801 Third Party Advisory VDB Entry
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na... Third Party Advisory
- https://kb.isc.org/docs/aa-01453 Vendor Advisory
- https://security.gentoo.org/glsa/201708-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180926-0005/ Third Party Advisory
- https://www.debian.org/security/2017/dsa-3795 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-476NULL Pointer Dereference
Timeline
Published16 Jan 2019
Updated28 Oct 2026
First seen6 Sep 2026
Track software like this
Free during beta