- 7.5HighCVSS base score
- 18.2%Exploitation in 30 daysEPSS · top 2.8% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Timeline
ID reserved
By isc
- 2 years later
· 2 years later
Published
- 6 years later
· 6 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| iscCNA (assigner) | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVDNVD · Modified | 3.0 | Medium5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 18.2% · top 2.8% of all CVEs (9 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
What to do
Solution: Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads. BIND 9 version 9.9.10-P2 BIND 9 version 9.10.5-P2 BIND 9 version 9.11.1-P2 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9 version 9.9.10-S3 BIND 9 version 9.10.5-S3
Workaround: The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in conjunction. For information on how to configure this type of compound authentication control, please see: https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html. Administrators who have made use of named.conf option "update-policy local;" should patch their servers as soon as possible and if this is not possible should replace the update-policy configuration statement with an allow-update statement implementing the key requirement for updates but additionally imposing an IP ACL limitation, e.g.: allow-update { !{ !localhost; }; key local-ddns; };
References
8
- https://kb.isc.org/docs/aa-01503 (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2017:1680 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2017:1679 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- 1038809 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- DSA-3904 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- 99337 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://security.netapp.com/advisory/ntap-20190830-0003/ (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2017-12284 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2017-3143)Record last updated .