CVE-2017-11104

Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.

Score

CVSS 3.1 5.9 Medium

Status

Modified - cve@mitre.org

Published

2017-07-08

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Debian Linux (Debian)
• Knot Dns (Knot-dns)

References

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00076.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00078.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00089.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00049.html
• http://www.debian.org/security/2017/dsa-3910
• http://www.securityfocus.com/bid/99598
• http://www.synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdf
• https://bugs.debian.org/865678
• https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.html