Combination of DNS64 and RPZ Can Lead to Crash

Published 7 y ago 2019-01-16 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

17.1%

percentile 97%

Public exploits

none known

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.

Exploit prediction (EPSS)

17.11% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:N/A:P`

Affected products

ISC BIND 9

Classification

Weakness

CWE-476 NULL Pointer Dereference

References

security.gentoo.org /glsa/201708-01 · vendor-advisory, x_refsource_GENTOO, x_transferred
rhn.redhat.com /errata/RHSA-2017-0276.html · vendor-advisory, x_refsource_REDHAT, x_transferred
security.netapp.com /advisory/ntap-20180926-0005/ · x_refsource_CONFIRM, x_transferred
h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_us · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/96150 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1037801 · vdb-entry, x_refsource_SECTRACK, x_transferred
debian.org /security/2017/dsa-3795 · vendor-advisory, x_refsource_DEBIAN, x_transferred
kb.isc.org /docs/aa-01453 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-3135
NVD: CVE-2017-3135

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.