CVE-2017-3141 : The BIND installer on Windows uses an unquoted service path which can enable a l

The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.

Published 2019-01-16 20:29:01

Updated 2019-10-09 23:27:18

Source Internet Systems Consortium (ISC)

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2017-3141

ISC » Bind
Versions from including (>=) 9.4.0 and up to, including, (<=) 9.8.8
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.9.0 and up to, including, (<=) 9.9.10
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.3.2 and up to, including, (<=) 9.3.6
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.2.6 and up to, including, (<=) 9.2.9
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.11.0 and up to, including, (<=) 9.11.1
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.10.0 and up to, including, (<=) 9.10.5
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.3.2 Update P1
cpe:2.3:a:isc:bind:9.3.2:p1:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.2.6 Update P2
cpe:2.3:a:isc:bind:9.2.6:p2:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2017-3141

Top countries where our scanners detected CVE-2017-3141

Top open port discovered on systems with this issue 53

IPs affected by CVE-2017-3141 332,460

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2017-3141!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2017-3141

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-3141

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.2	HIGH	CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H	0.6	6.0	Internet Systems Consortium (ISC)
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-3141

CWE-428 Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-3141

http://www.securityfocus.com/bid/99089

ISC BIND CVE-2017-3141 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
https://security.netapp.com/advisory/ntap-20180926-0001/

June 2017 ISC BIND Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1038693

BIND Windows Installer Unquoted Service Path Lets Local Users Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/42121/

BIND 9.10.5 - Unquoted Service Path Privilege Escalation
Exploit;Third Party Advisory;VDB Entry
https://kb.isc.org/docs/aa-01496

CVE-2017-3141: Windows service and uninstall paths are not quoted when BIND is installed - Security Advisories
Vendor Advisory
https://security.gentoo.org/glsa/201708-01

BIND: Multiple vulnerabilities (GLSA 201708-01) — Gentoo security
Third Party Advisory

CVEs referencing this url