Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1441137 (CVE-2017-3138) - CVE-2017-3138 bind: REQUIRE assertion failure when null command string on control channel is received
Summary: CVE-2017-3138 bind: REQUIRE assertion failure when null command string on con...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-3138
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1441925 1441926
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-04-11 09:51 UTC by Adam Mariš
Modified: 2021-02-17 02:21 UTC (History)
4 users (show)

Fixed In Version: bind 9.9.9-P8, bind 9.10.4-P8, bind 9.11.0-P5
Clone Of:
Environment:
Last Closed: 2017-04-24 06:45:25 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3003871 0 None None None 2017-04-18 05:12:53 UTC

Description Adam Mariš 2017-04-11 09:51:46 UTC
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.

The BIND control channel is not configured by default, but when configured will accept commands from those IP addresses that are specified in its access control list and/or from clients which present the proper transaction key.  Using this defect, an attacker can cause a running server to stop if they can get it to accept control channel input from them.  In most instances this is not as bad as it sounds, because existing commands permitted over the control channel (i.e. "rndc stop") can already be given to cause the server to stop. However, BIND 9.11.0 introduced a new option to allow "read only" commands over the command channel.  Using this restriction, a server can be configured to limit specified clients to giving control channel commands which return information only (e.g. "rndc status") without affecting the operational state of the server.  The defect described in this advisory, however, is not properly stopped by the "read only" restriction, in essence permitting a privilege escalation allowing a client which should only be permitted the limited set of "read only" operations to cause the server to stop execution.

External References:

https://kb.isc.org/article/AA-01471

Comment 1 Adam Mariš 2017-04-11 09:51:53 UTC
Acknowledgments:

Name: ISC
Upstream: Mike Lalumiere (Dyn)

Comment 3 Dhiru Kholia 2017-04-12 11:15:20 UTC
Statement:

This issue does not affect bind as shipped with Red Hat Enterprise Linux 5, 6 and 7 as it does not contain the affected code.

Comment 4 Dhiru Kholia 2017-04-13 06:04:00 UTC
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1441925]

Comment 5 Dhiru Kholia 2017-04-13 06:04:09 UTC
Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1441926]


Note You need to log in before you can comment on or make changes to this bug.