CVE-2017-3138
named exits with a REQUIRE assertion failure if it receives a null command string on its control channel
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jan 16, 2019
- Updated
- Sep 16, 2024
- Reserved
- Dec 2, 2016
Description
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.5 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | isc |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
BIND 9ISC |
|
References
- 1038260vdb-entry
- 97657vdb-entry
- GLSA-201708-01vendor-advisory
- https://security.netapp.com/advisory/ntap-20180802-0002/
- DSA-3854vendor-advisory
- https://kb.isc.org/docs/aa-01471
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.