VDB
ALPINE-CVE-2017-3142
ALPINE-CVE-2017-3142
PUBLISHED
CVSS 3.700000047683716 LOW
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Risk Scores
CVSS 3.0
3.700000047683716
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.5 | bind | 9.10.1_p1-r0, 9.10.1-r2, 9.10.1-r0 |
| Alpine:v3.3 | bind | 9.9.3_p2-r2, 0, 9.9.5-r0 |
| Alpine:v3.7 | bind | 9.10.0-r0, 9.10.0_p1-r0, 9.10.0_p2-r0 |
| Alpine:v3.4 | bind | 9.9.2-r0, *, * |
| Alpine:v3.6 | bind | 0, 9.9.5-r0, 9.9.4 |
Timeline
- Jan 16, 2019 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated