Unquoted search path in ISC BIND - CVE-2017-3141

Vulnerability identifier: #VU7092

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2017-3141

CWE-ID: CWE-428

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unquotes search path in BIND installer for Windows during installation process. An attacker with ability to place specially crafted library into the folder, from which the BIND installer is executed, can obtain elevated privileges on the system.

Only Windows systems are affected by this issue.

ISC BIND
Gentoo Linux
bind (Alpine package)

Use the latest installer for  versions 9.9.10-P1, 9.10.5-P1 or 9.11.1-P1.

bind (Alpine package) - addressed in versions 9.10.4_p8-r1, 9.11.3-r0

• Exploit #1241 - BIND 9.10.5 - Unquoted Service Path Privilege Escalation (March 18, 2020)

• https://kb.isc.org/article/AA-01496/74/CVE-2017-3141%3A-Windows-service-and-uninstall-paths-are-not-...

• Privilege escalation in ISC BIND installer for Windows
• Gentoo update for BIND
• Unquoted search path in bind (Alpine package)