[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e8547db4-2186-98a4-0247-de855e202879@isc.org>
Date: Tue, 16 Jan 2018 15:25:46 -0600
From: ISC Security Officer <security-officer@....org>
To: oss-security@...ts.openwall.com
Cc: ISC Security Officer <security-officer@....org>
Subject: New vulnerability in ISC BIND announced (CVE-2017-3145)
Please be advised that ISC public announced a vulnerability in ISC BIND.
CVE-2017-3145 is a denial-of-service vector which can potentially be
exploited against ISC BIND servers, causing them to crash. The
underlying flaw has existed since BIND 9.0.0 but is not known to be
reachable in any version prior to those containing the fix for
CVE-2017-3137 [9.9.9-P8 to 9.9.11, 9.10.4-P8 to 9.10.6, 9.11.0-P5 to
9.11.2, 9.9.9-S10 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, and 9.12.0a1 to
9.12.0rc1], and then only when acting as DNSSEC validating resolvers.
Our full CVE text can be found at https://kb.isc.org/article/AA-01542
New releases of ISC BIND, including security fixes for this
vulnerability, are available at: https://www.isc.org/downloads/
Release notes can be obtained using the following links:
ftp://ftp.isc.org/isc/bind9/9.9.11-P1/RELEASE-NOTES-bind-9.9.11-P1.txt
ftp://ftp.isc.org/isc/bind9/9.10.6-P1/RELEASE-NOTES-bind-9.10.6-P1.txt
ftp://ftp.isc.org/isc/bind9/9.11.2-P1/RELEASE-NOTES-bind-9.11.2-P1.txt
ftp://ftp.isc.org/isc/bind9/9.12.0rc3/RELEASE-NOTES-bind-9.12.0rc3.txt
--
Brian Conry
ISC Support
Acting Security Officer
Download attachment "signature.asc" of type "application/pgp-signature" (521 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
