Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-3145: BIND DNS server may crash during name lookups
CVE-2017-3145 · published 7 years ago
Summary
The BIND DNS software used in many networks can unexpectedly stop working because it sometimes tries to use data that has already been cleared. This can cause the DNS service to crash, interrupting name resolution for users. Upgrade to the latest BIND release or apply the vendor’s patch to prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| isc | bind |
>= 9.4.0, <= 9.8.8 >= 9.9.0, <= 9.9.11 >= 9.10.0, <= 9.10.6 >= 9.11.0, <= 9.11.2 9.9.3 9.9.11 9.10.5 9.10.6 9.12.0 cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
6.4 6.5 6.6 7.2 7.3 7.4 7.6 cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_eus |
6.7 7.3 7.4 7.5 7.6 cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus |
6.6 7.2 7.3 7.6 cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |
| debian | debian_linux |
7.0 8.0 9.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| netapp | data_ontap_edge |
All versions
cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:* |
| juniper | junos |
12.1x46-d76 12.3x48-d70 15.1x49-d140 17.4r2 18.1r2 18.2r1 cpe:2.3:o:juniper:junos:12.1x46-d76:-:*:*:*:*:*:* |
Original advisory text
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Aff...
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.
References
- https://www.debian.org/security/2018/dsa-4089 Third Party Advisory
- http://www.securityfocus.com/bid/102716 Broken Link Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1040195 Broken Link Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0101 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0102 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0487 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0488 Third Party Advisory
- https://kb.isc.org/docs/aa-01542 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/01/msg00029.html Mailing List Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180117-0003/ Third Party Advisory
- https://supportportal.juniper.net/s/article/2018-07-Security-Bulletin-SRX-Series... Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-416Use After Free
Timeline
Published16 Jan 2019
Updated28 Oct 2026
First seen6 Sep 2026
Track software like this
Free during beta