What’s Vulnerable › Vulnerabilities
CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers
- Severity: low (CVSS 3.7 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-01-16 · updated 2026-06-17
- Weakness: CWE-20
Description
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Affected products
- Debian Linux: 8.0, 9.0
- ISC BIND: from 9.4.0 through 9.8.8; from 9.9.0 through 9.9.10; from 9.10.0 through 9.10.5; from 9.11.0 through 9.11.1; 9.9.0-p1, 9.9.3-s1, 9.9.10-s2, 9.10.5-p1, 9.10.5-s1, 9.10.5-s2 (+1)
- RedHat Enterprise Linux Desktop: 6.0, 7.0
- RedHat Enterprise Linux Server: 6.0, 7.0
- RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6
- RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5, 7.6
- RedHat Enterprise Linux Server Tus: 7.3, 7.6
- RedHat Enterprise Linux Workstation: 6.0, 7.0
References
- http://www.securityfocus.com/bid/99339
- http://www.securitytracker.com/id/1038809
- https://access.redhat.com/errata/RHSA-2017:1679
- https://access.redhat.com/errata/RHSA-2017:1680
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us
- https://kb.isc.org/docs/aa-01504
- https://security.netapp.com/advisory/ntap-20190830-0003/
- https://www.debian.org/security/2017/dsa-3904
- http://www.securityfocus.com/bid/99339
- http://www.securitytracker.com/id/1038809
- https://access.redhat.com/errata/RHSA-2017:1679
- https://access.redhat.com/errata/RHSA-2017:1680
Get alerted when CVE-2017-3142 or the next vulnerability affects your stack