WaratekVRT Sign in

CVE-2017-3137 BIND

Affected softwareBIND
Severity7.5 High CVSS 3.0 3 scores
WeaknessCWE-617
Published16 Jan 2019
Updated17 Jun 2026

Description

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 8.9% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H security-officer@isc.org Secondary published
CVSS 3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

11 products, 39 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 8.0
nvd isc bind generic 9.9.9:p6 · 9.9.9:s8 · 9.9.10:beta1 · 9.9.10:rc1 · 9.10.4:p6 · 9.10.5:rc1 · 9.10.5:b1 · 9.11.0:p3 · 9.11.1:rc1 · 9.11.1:b1
nvd netapp data ontap edge generic any version
nvd netapp element software generic any version
nvd netapp oncommand balance generic any version
nvd redhat enterprise linux desktop generic 6.0 · 7.0
nvd redhat enterprise linux server generic 6.0 · 7.0
nvd redhat enterprise linux server aus generic 6.2 · 6.4 · 6.5 · 6.6 · 7.2 · 7.3 · 7.4 · 7.6
nvd redhat enterprise linux server eus generic 6.7 · 7.2 · 7.3 · 7.4 · 7.5 · 7.6
nvd redhat enterprise linux server tus generic 6.5 · 6.6 · 7.2 · 7.3 · 7.6
nvd redhat enterprise linux workstation generic 6.0 · 7.0

References

URLTags
http://www.securityfocus.com/bid/97651 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038258 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040195 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1095 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1105 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1582 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1583 Third Party Advisory
https://kb.isc.org/docs/aa-01466 Vendor Advisory
https://security.gentoo.org/glsa/201708-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20180802-0002/ Third Party Advisory

Timeline
Published2019-01-16By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.