[German]A vulnerability in BIND (performing DNS resolutions) may cause the named daemon to crash. Here are some information about the vulnerability, that since 2000.
Advertising
I don't know if someone of my blog readers runs an own BIND server with this open source software, because Microsoft Windows is using its own BIND implementation for DNS servers. The issue may affect administrators in corporate environments, running ICS BIND.
According to Wikipedia BIND (Berkeley Internet Name Domain Server) is the most widely used Domain Name System (DNS) software on the Internet. On Unix-like operating systems it is the de facto standard.
On January 16, 2018 the article CVE-2017-3145: Improper fetch cleanup sequencing in the resolver can cause named to crash has been published. The CVE is saying, BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts. This is leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. It seems that the bug in BIND is present since 2000, as The Register wrote here.
While this bug has existed in BIND since 9.0.0, there are no known code paths leading to it in ISC releases prior to those containing the fix for CVE-2017-3137. Thus while all instances of BIND ought to be patched, only ISC versions [9.9.9-P8 to 9.9.11, 9.10.4-P8 to 9.10.6, 9.11.0-P5 to 9.11.2, 9.9.9-S10 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, and 9.12.0a1 to 9.12.0rc1] acting as DNSSEC validating resolvers are currently known to crash due to this bug. The known crash is an assertion failure in netaddr.c. Further details may be obtained from CVE-2017-3145: Improper fetch cleanup sequencing in the resolver can cause named to crash.
