#VU7550 Authentication bypass in Knot DNS - CVE-2017-11104

Vulnerability identifier: #VU7550

Vulnerability risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-11104

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Knot DNS
Server applications / DNS servers

Vendor: Nic

Description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the TSIG protocol implementation. A remote attacker can use a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set.

Mitigation
The vulnerability is addressed in the following versions: 2.4.5 and 2.5.2.

Vulnerable software versions

Knot DNS: 2.0.0 - 2.5.1

---

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.