CVE-2017-3135

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Jan 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-31365.9A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker CVE-2017-31377.5Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead CVE-2017-31385.3named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a contro CVE-2017-31397.5A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexp CVE-2017-31405.9If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endles CVE-2017-31417.8The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file s CVE-2017-31423.7An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be ab CVE-2017-31435.9An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the z CVE-2017-31447.5A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors CVE-2017-31457.5BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that CVE-2017-31506.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.CVE-2017-31516.1Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionali