CVE-2017-3143
- ULN >
- Oracle Linux CVE repository >
- CVE-2017-3143
CVE Details
| Release Date: | 2019-01-16 | |
| Impact: | Important | What is this? |
Description
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
See more information about CVE-2017-3143 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 metrics
| Base Score: | 5.9 |
| Vector String: | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Version: | 3.0 |
| Attack Vector: | Network |
| Attack Complexity: | High |
| Privileges Required: | None |
| User Interaction: | None |
| Scope: | Unchanged |
| Confidentiality Impact: | None |
| Integrity Impact: | High |
| Availability Impact: | None |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 6 (bind) | ELSA-2017-1679 | 2017-07-05 |
| Oracle Linux version 7 (bind) | ELSA-2017-1680 | 2017-07-05 |
| Oracle VM version 3.3 (bind) | OVMSA-2017-0122 | 2017-07-05 |
| Oracle VM version 3.4 (bind) | OVMSA-2017-0122 | 2017-07-05 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
