CVE-2017-3138
Estado: ModificadaMedia (5.3)—
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 5.52%
- Percentil entre todas las CVEs puntuadas: 93
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (5)
CWE
- CWE-617
Referencias
- http://www.securityfocus.com/bid/97657
- http://www.securitytracker.com/id/1038260
- https://kb.isc.org/docs/aa-01471
- https://security.gentoo.org/glsa/201708-01
- https://security.netapp.com/advisory/ntap-20180802-0002/
- https://www.debian.org/security/2017/dsa-3854
- http://www.securityfocus.com/bid/97657
- http://www.securitytracker.com/id/1038260
- https://kb.isc.org/docs/aa-01471
- https://security.gentoo.org/glsa/201708-01
- https://security.netapp.com/advisory/ntap-20180802-0002/
- https://www.debian.org/security/2017/dsa-3854
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-3138",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "security-officer@isc.org",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.6
}
]
},
"affected": [
{
"source": "security-officer@isc.org",
"affectedData": [
{
"vendor": "ISC",
"product": "BIND 9",
"versions": [
{
"status": "affected",
"version": "9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9"
}
]
}
]
}
],
"published": "2019-01-16T20:29:00.407",
"references": [
{
"url": "http://www.securityfocus.com/bid/97657",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security-officer@isc.org"
},
{
"url": "http://www.securitytracker.com/id/1038260",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security-officer@isc.org"
},
{
"url": "https://kb.isc.org/docs/aa-01471",
"tags": [
"Vendor Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://security.gentoo.org/glsa/201708-01",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20180802-0002/",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://www.debian.org/security/2017/dsa-3854",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "http://www.securityfocus.com/bid/97657",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1038260",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://kb.isc.org/docs/aa-01471",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201708-01",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20180802-0002/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2017/dsa-3854",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-617"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9."
},
{
"lang": "es",
"value": "named contiene una característica que permite que los operadores envíe comandos a un servidor en ejecución comunicándose con el proceso del servidor mediante un canal de control utilizando un programa como rndc. Una regresión empleada en un cambio de características reciente ha creado una situación en la cual algunas versiones de named pueden cerrarse con un error de aserción de REQUIRE si se le envía una cadena de comandos null. Afecta a BIND desde la versión 9.9.9 hasta la 9.9.9-P7, desde la versión 9.9.10b1 hasta la 9.9.10rc2, desde la versión 9.10.4 hasta la 9.10.4-P7, desde la versión 9.10.5b1 hasta la 9.10.5rc2, desde la versión 9.10.5b1 hasta la 9.10.5rc2, desde la versión 9.11.0 hasta la 9.11.0-P4, desde la versión 9.11.1b1 hasta la 9.11.1rc2 y desde la versión 9.9.9-S1 hasta 9.9.9-S9."
}
],
"lastModified": "2026-06-17T01:17:35.850",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AECB4D34-0D20-46C5-A389-0296EF60E795"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "376915CA-6BDB-423E-B216-64B098344DD9"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03215B90-9860-4CB4-B7D2-3DF045B129EB"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "88335D70-E98B-469E-A2E7-1958EB5F10DA"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "795DA9EE-489D-402E-8427-C9E3650BA1E2"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "012A3C08-2A0F-4168-9DE0-F609707E4C2E"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BDE2752-E5CD-4AE6-A404-2C209F942B7A"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0387826C-AE6B-44C8-9888-4088CF66D78C"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:s1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21FBF6B7-BA47-46AC-B7EB-3A3A2E985BFD"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.9:s7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7132A53F-7DF2-4B79-AC86-75A0C73843B4"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.10:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C8F0163-FF32-44E0-B05C-F89263CD56A7"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.10:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94C0C9FC-5CCF-4AD7-8D83-7B579102F7E7"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.9.10:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFF50431-599D-40DD-A2B3-30A6D5652FFA"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E76DCB3-8063-415D-A774-9191E69E6980"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB2D2132-62E8-4E73-A0BF-4790DAFC5558"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E253BD9F-25B8-42E7-BEAB-E843381ED155"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B5E42E5-27C6-4D6F-B7DC-903B10BF2017"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E211374-A4F5-41D4-A89E-E6522E9D0DFB"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21CC7BA7-6D75-4561-ACF3-F1F61A0CBA62"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70586A2A-AA52-48F5-B2B0-390CA77807E8"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.4:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "060E10B1-5501-4BD0-A148-B04C56D499F3"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.5:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C5A0370-9490-40CC-84E8-EEE95A6F233B"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.5:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEC78396-4667-4A45-8DBD-0D0C2AAE1549"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.5:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CD813E5-0C4A-4B55-A1B9-9C5C6C2504D4"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3160C5ED-75EA-47B2-998E-EDFC46B37DDA"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.0:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "086C327B-DF9F-4D4E-A538-1E29FEDC34C5"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.0:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1440B408-76B6-4FA7-899D-E28049A37704"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.0:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D50373F-C1C4-4EC9-B94F-854C3444717D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.0:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6658F26D-C088-4470-8AFD-58BB54201C87"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.1:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A923D26C-3BE1-492E-99CF-1BB14D8A6388"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.1:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EEA791E2-27E0-49C5-9823-0C57647C788F"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.1:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E654717-4EF6-4397-A637-A9789CD5D1D6"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0C4B1E5-75BF-43AE-BBAC-0DD4124C71ED"
},
{
"criteria": "cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85DF4B3F-4BBC-42B7-B729-096934523D63"
},
{
"criteria": "cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DCBCC5D-C396-47A8-ADF4-D3A2C4377FB1"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-officer@isc.org"
}