WaratekVRT Sign in

CVE-2017-3136 BIND

Affected softwareBIND
Severity5.9 Medium CVSS 3.0 3 scores
WeaknessCWE-617
Published16 Jan 2019
Updated17 Jun 2026

Description

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 11% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

5.9 MEDIUM v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H security-officer@isc.org Secondary published
CVSS 3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

11 products, 47 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 8.0
nvd isc bind generic ≥ 9.8.0 and ≤ 9.8.8 · 9.8.0:p1 · ≥ 9.9.0 and ≤ 9.9.9 · 9.9.0:p1 · 9.9.0:p2 · 9.9.0:p3 · 9.9.0:p4 · 9.9.0:p5 · 9.9.0:p6 · 9.9.3 · 9.9.3:s1 · 9.9.10:beta1 · 9.9.10:rc1 · ≥ 9.10.0 and ≤ 9.10.4 · 9.10.4:p1 · 9.10.4:p2 · 9.10.4:p3 · 9.10.4:p4 · 9.10.4:p5 · 9.10.4:p6 · 9.10.5:rc1 · 9.10.5:b1 · 9.11.0 · 9.11.0:p1 · 9.11.0:p2 · 9.11.0:p3 · 9.11.1:beta1 · 9.11.1:rc1
nvd netapp data ontap edge generic any version
nvd netapp element software generic any version
nvd netapp oncommand balance generic any version
nvd redhat enterprise linux desktop generic 6.0 · 7.0
nvd redhat enterprise linux server generic 6.0 · 7.0
nvd redhat enterprise linux server aus generic 7.3 · 7.4 · 7.6
nvd redhat enterprise linux server eus generic 7.3 · 7.4 · 7.5 · 7.6
nvd redhat enterprise linux server tus generic 7.3 · 7.6
nvd redhat enterprise linux workstation generic 6.0 · 7.0

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
http://www.securityfocus.com/bid/97653 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038259 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1095 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1105 Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_us Third Party Advisory
https://kb.isc.org/docs/aa-01465 Vendor Advisory
https://security.gentoo.org/glsa/201708-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20180802-0002/ Third Party Advisory

Timeline
Published2019-01-16By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.