CVE-2017-3143

Solution:

• Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads. BIND 9 version 9.9.10-P2 BIND 9 version 9.10.5-P2 BIND 9 version 9.11.1-P2 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9 version 9.9.10-S3 BIND 9 version 9.10.5-S3

Workaround:

• The effects of this vulnerability can be mitigated by using Access Control Lists (ACLs) that require both address range validation and use of TSIG authentication in conjunction. For information on how to configure this type of compound authentication control, please see: https://kb.isc.org/article/AA-00723/0/Using-Access-Control-Lists-ACLs-with-both-addresses-and-keys.html. Administrators who have made use of named.conf option "update-policy local;" should patch their servers as soon as possible and if this is not possible should replace the update-policy configuration statement with an allow-update statement implementing the key requirement for updates but additionally imposing an IP ACL limitation, e.g.: allow-update { !{ !localhost; }; key local-ddns; };