# MA-671.072017: MyCERT Advisory - ISC Releases Security Updates

**Date:** 02 Jul 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-671.072017  
**Advisory ID:** MA-671.072017

---

**1.0 Introduction**
The Internet Systems Consortium (ISC) has released updates that address two vulnerabilities in BIND. Users and administrators are encouraged to review ISC Knowledge Base Articles AA-01503 and AA-01504 and apply the necessary updates.
**2.0 Impact**
Exploitation of this vulnerability may allow an attacker to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update.
**3.0 Affected Products**
The affected products of Bind is as listed below:
• Bind 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2
**4.0 Recommendations**
4.1 Upgrade to the patched release most closely 
• BIND 9 versions 9.9.10-P2
<https://www.isc.org/downloads/file/bind-9.9.10-P2/?version=tar-gz>
<https://www.isc.org/downloads/file/bind-9.9.10-P2/?version=win-32-bit>
<https://www.isc.org/downloads/file/bind-9.9.10-P2/?version=win-64-bit>
• BIND 9 version 9.10.5-P2
<https://www.isc.org/downloads/file/bind-9.10.5-P2/?version=tar-gz>
<https://www.isc.org/downloads/file/bind-9.10.5-P2/?version=win-32-bit>
<https://www.isc.org/downloads/file/bind-9.10.5-P2/?version=win-64-bit>
• BIND 9 version 9.11.1-P2
<https://www.isc.org/downloads/file/bind-9.11.1-P2/?version=tar-gz>
<https://www.isc.org/downloads/file/bind-9.11.1-P2/?version=win-32-bit>
<https://www.isc.org/downloads/file/bind-9.11.1-P2/?version=win-64-bit>
• BIND 9 version 9.9.10-S3 and 9.10.5-S3
BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.
Note: For current information, on which versions are actively supported, please see <http://www.isc.org/downloads/>
4.2 For more information, please refer ISC Knowledge Base Articles AA-01503 and AA-01504
• CVE-2017-3143
<https://kb.isc.org/article/AA-01503>
• CVE-2017-3142
[https://kb.isc.org/article/AA-01504](https://kb.isc.org/article/AA-01503)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#781b011a1d0a414141381b011a1d0a0b1d1b0d0a110c01561501) or [[email protected]](/cdn-cgi/l/email-protection#5d30243e382f291d30243e382f2973322f3a733024) â€¨
Phone: 1-300-88-2999 (monitored during business hours)â€¨
Fax: +603 89453442 â€¨Mobile: +60 19 2665850 (24x7 call incident reporting)â€¨
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888â€¨
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYTâ€¨
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://kb.isc.org/article/AA-01504/74/CVE-2017-3142%3A-An-error-in-TSIG-authentication-can-permit-unauthorized-zone-transfers.html>
• <https://kb.isc.org/article/AA-01503/74/CVE-2017-3143%3A-An-error-in-TSIG-authentication-can-permit-unauthorized-dynamic-updates.html>