Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-3145: A use-after-free flaw leading to denial of service was found in the way BIND internally handled cleanup operations on upstream recursion fetch contexts. A remote attacker could potentially use this flaw to make named, acting as a DNSSEC validating resolver, exit unexpectedly with an assertion failure via a specially crafted DNS request. 1534812: CVE-2017-3145 bind: Improper fetch cleanup sequencing in the resolver can cause named to crash
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | bind | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-chroot | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-debuginfo | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-devel | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-libs | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-libs-lite | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-license | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-lite-devel | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-pkcs11 | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-pkcs11-devel | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-pkcs11-libs | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-pkcs11-utils | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-sdb | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-sdb-chroot | 32:9.9.4-51.amzn2.2 |
| Amazon Linux · 2 | bind-utils | 32:9.9.4-51.amzn2.2 |
Vulnerabilities 1
-
High 7.5CVE-2017-3145 EPSS 28%
Improper fetch cleanup sequencing in the resolver can cause named to crash
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2017-3145.html