← Back

CVE-2017-3141

nvd nist
Published: Jan 16, 2019Modified: Nov 21, 2024

JSON object

Loading...
7.8
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.

Affected (8)

Products: Isc: Bind
Isc
1 product
Bind
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Isc
Bind
9.10.0 ≤ version ≤ 9.10.5
Bind
9.11.0 ≤ version ≤ 9.11.1
Bind
9.2.6 ≤ version ≤ 9.2.9
Bind
9.3.2 ≤ version ≤ 9.3.6
Bind
9.4.0 ≤ version ≤ 9.8.8
Bind
9.9.0 ≤ version ≤ 9.9.10
Bind
Version 9.2.6 p2
Bind
Version 9.3.2 p1

Related CWEs

CWE-428
Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

References (12)

Source: security-officer@isc.org
Third Party AdvisoryVDB Entry
Source: security-officer@isc.org
Third Party AdvisoryVDB Entry
Source: security-officer@isc.org
Vendor Advisory
Source: security-officer@isc.org
Third Party Advisory
Source: security-officer@isc.org
Third Party Advisory
Source: security-officer@isc.org
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.