Summary
Clément Berthaux discovered that Bind did not correctly check TSIG
authentication for zone update requests. An attacker could use this
to improperly perform zone updates. (CVE-2017-3143)
Clément Berthaux discovered that Bind did not correctly check TSIG
authentication for zone transfer requests. An attacker could use this
to improperly transfer entire zones. (CVE-2017-3142)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.15 |
| Ubuntu · 16.04 LTS 16.04:LTS | bind9 | 1:9.10.3.dfsg.P4-8ubuntu1.7 |
Vulnerabilities 2
-
High 7.5
An error in TSIG authentication can permit unauthorized dynamic updates
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BI…
-
Medium 5.3
An error in TSIG authentication can permit unauthorized zone transfers
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies …