Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2017-3140— An error processing RPZ rules can cause named to loop endlessly after handling a query

Quick assessment

Affected

ISC BIND 9

Exploitation

High exploitation probability; assess promptly

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ISC BIND是美国Internet Systems Consortium（ISC）公司所维护的一套实现了DNS协议的开源软件。 ISC BIND中存在远程拒绝服务漏洞。远程攻击者可利用该漏洞造成拒绝服务（无限循环）。以下版本受到影响：ISC BIND 9.9.10版本，9.10.5版本，9.11.0版本至9.11.1版本，9.9.10-S1版本，9.10.5-S1版本。

AI Predicted 7.5 Difficulty: Moderate EPSS 12.23% · P96 Updated Feb 21, 2026

Possible ATT&CK Techniques 1 AI

T1011 · Exfiltration Over Other Network Medium

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-3140

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

An error processing RPZ rules can cause named to loop endlessly after handling a query

Source: CVE Program / CVE List V5

Vulnerability Description

If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

ISC BIND 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ISC	BIND 9	9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1	-

II. Public POCs for CVE-2017-3140

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2017-3140

请登录查看更多情报信息。

Vendor Advisories for CVE-2017-3140 (4)

🔗 https://security.netapp.com/advisory/ntap-20180926-0001/ x_refsource_CONFIRM
🔗 http://www.securityfocus.com/bid/99088 vdb-entry x_refsource_BID
🔗 http://www.securitytracker.com/id/1038692 vdb-entry x_refsource_SECTRACK
🔗 https://security.gentoo.org/glsa/201708-01 vendor-advisory x_refsource_GENTOO

Other References for CVE-2017-3140 (2)

🔗 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us x_refsource_CONFIRM
🔗 https://kb.isc.org/docs/aa-01495 x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2017-3140

Same Patch Batch · ISC · 2019-01-16 · 18 CVEs total

CVE-2017-3144		Failure to properly clean up closed OMAPI connections can exhaust available sockets
CVE-2018-5741		Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their
CVE-2018-5740		A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named
CVE-2018-5739		Failure to release memory may exhaust system resources
CVE-2018-5738		Some versions of BIND can improperly permit recursive query service to unauthorized client
CVE-2018-5737		BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other
CVE-2018-5734		A malformed request can trigger an assertion failure in badcache.c
CVE-2018-5733		A malicious client can overflow a reference counter in ISC dhcpd
CVE-2017-3145		Improper fetch cleanup sequencing in the resolver can cause named to crash
CVE-2016-9778		An error handling certain queries using the nxdomain-redirect feature could cause a REQUIR
CVE-2017-3143		An error in TSIG authentication can permit unauthorized dynamic updates
CVE-2017-3142		An error in TSIG authentication can permit unauthorized zone transfers
CVE-2017-3141		Windows service and uninstall paths are not quoted when BIND is installed
CVE-2017-3138		named exits with a REQUIRE assertion failure if it receives a null command string on its c
CVE-2017-3137		A response packet can cause a resolver to terminate when processing an answer containing a
CVE-2017-3136		An error handling synthesized records could cause an assertion failure when using DNS64 wi
CVE-2017-3135		Combination of DNS64 and RPZ Can Lead to Crash

IV. Related Vulnerabilities

Same product: BIND 9

Same vendor: ISC

V. Comments for CVE-2017-3140

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2017-3140— An error processing RPZ rules can cause named to loop endlessly after handling a query

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2017-3140

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2017-3140

III. Intelligence Information for CVE-2017-3140

Vendor Advisories for CVE-2017-3140 (4)

Other References for CVE-2017-3140 (2)

Same Patch Batch · ISC · 2019-01-16 · 18 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2017-3140

Leave a comment