CVE Vulnerabilities

CVE-2017-3135

NULL Pointer Dereference

Published: Jan 16, 2019 | Modified: Oct 09, 2019
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Bind Isc 9.9.3 (including) 9.9.3 (including)
Bind Isc 9.9.3-s1 (including) 9.9.3-s1 (including)
Bind Isc 9.9.8 (including) 9.9.8 (including)
Bind Isc 9.9.9-p5 (including) 9.9.9-p5 (including)
Bind Isc 9.9.9-s7 (including) 9.9.9-s7 (including)
Bind Isc 9.9.10-beta1 (including) 9.9.10-beta1 (including)
Bind Isc 9.10.0 (including) 9.10.0 (including)
Bind Isc 9.10.4-p1 (including) 9.10.4-p1 (including)
Bind Isc 9.10.4-p2 (including) 9.10.4-p2 (including)
Bind Isc 9.10.4-p3 (including) 9.10.4-p3 (including)
Bind Isc 9.10.4-p4 (including) 9.10.4-p4 (including)
Bind Isc 9.10.4-p5 (including) 9.10.4-p5 (including)
Bind Isc 9.10.5-beta1 (including) 9.10.5-beta1 (including)
Bind Isc 9.11.0 (including) 9.11.0 (including)
Bind Isc 9.11.0-p1 (including) 9.11.0-p1 (including)
Bind Isc 9.11.0-p2 (including) 9.11.0-p2 (including)
Bind Isc 9.11.1-beta1 (including) 9.11.1-beta1 (including)

Potential Mitigations

References