Bug 1441137 (CVE-2017-3138) - CVE-2017-3138 bind: REQUIRE assertion failure when null command string on control channel is received
Summary: CVE-2017-3138 bind: REQUIRE assertion failure when null command string on con...
Alias: CVE-2017-3138
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1441925 1441926
Blocks: 1441140
TreeView+ depends on / blocked
Reported: 2017-04-11 09:51 UTC by Adam Mariš
Modified: 2021-02-17 02:21 UTC (History)
4 users (show)

Fixed In Version: bind 9.9.9-P8, bind 9.10.4-P8, bind 9.11.0-P5
Doc Type: If docs needed, set a value
Doc Text:
A denial of service flaw was found in the way BIND processed control channel commands. A remote attacker with access to the BIND control channel could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted command.
Clone Of:
Last Closed: 2017-04-24 06:45:25 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3003871 0 None None None 2017-04-18 05:12:53 UTC

Description Adam Mariš 2017-04-11 09:51:46 UTC
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.

The BIND control channel is not configured by default, but when configured will accept commands from those IP addresses that are specified in its access control list and/or from clients which present the proper transaction key.  Using this defect, an attacker can cause a running server to stop if they can get it to accept control channel input from them.  In most instances this is not as bad as it sounds, because existing commands permitted over the control channel (i.e. "rndc stop") can already be given to cause the server to stop. However, BIND 9.11.0 introduced a new option to allow "read only" commands over the command channel.  Using this restriction, a server can be configured to limit specified clients to giving control channel commands which return information only (e.g. "rndc status") without affecting the operational state of the server.  The defect described in this advisory, however, is not properly stopped by the "read only" restriction, in essence permitting a privilege escalation allowing a client which should only be permitted the limited set of "read only" operations to cause the server to stop execution.

External References:


Comment 1 Adam Mariš 2017-04-11 09:51:53 UTC

Name: ISC
Upstream: Mike Lalumiere (Dyn)

Comment 3 Dhiru Kholia 2017-04-12 11:15:20 UTC

This issue does not affect bind as shipped with Red Hat Enterprise Linux 5, 6 and 7 as it does not contain the affected code.

Comment 4 Dhiru Kholia 2017-04-13 06:04:00 UTC
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1441925]

Comment 5 Dhiru Kholia 2017-04-13 06:04:09 UTC
Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1441926]

Note You need to log in before you can comment on or make changes to this bug.