CVE-2017-3143

An error in TSIG authentication can permit unauthorized dynamic updates

High · published January 16, 2019

CVSS v3.0

7.5

EPSS

18%

Percentile

97.2

In the wild

Unconfirmed

What it is

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

The record

Technical detail

CVSS v3.0: 7.5 · HIGH
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.18299 · 97.2th percentile
Published: 2019-01-16T20:00Z

EPSS history

Timeline

16 JAN 20:00Z
An error in TSIG authentication can permit unauthorized dynamic updates
cvelistv5