CVE-2018-5740

CWE-617 — Reachable Assertion11 documents8 sources
Severity
7.5HIGH
EPSS
64.5%
top 1.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
ISC BindISC Bind 9Canonical Ubuntu Linux+7 more
Timeline
PublishedJan 16
Latest updateMay 13

Description

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶NVDisc/bind9.7.0 — 9.8.8+5
▶Debianbind9< 1:9.11.4.P1+dfsg-1+3
▶CVEListV5isc/bind_9BIND 9 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2
▶NVDopensuse/leap15.0, 15.1, 42.3+2

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, Enterprise Linux 7.6, 7.5

🔴Vulnerability Details

3
GHSA
GHSA-rqpc-6vjv-w22p: "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potentia↗2022-05-13
▶
OSV
CVE-2018-5740: "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potentia↗2019-01-16
▶
CVEList
A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named↗2019-01-16
▶

📋Vendor Advisories

4
Ubuntu
Bind vulnerability↗2018-10-01
▶
Ubuntu
Bind vulnerability↗2018-09-20
▶
Red Hat
bind: processing of certain records when "deny-answer-aliases" is in use may trigger an assert leading to a denial of service↗2018-08-08
▶
Debian
CVE-2018-5740: bind9 - "deny-answer-aliases" is a little-used feature intended to help recursive server...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-5740 bind: processing of certain records when "deny-answer-aliases" is in use may trigger an assert leading to a denial of service [fedora-all]↗2018-08-08
▶
Bugzilla
CVE-2018-5740 bind: processing of certain records when "deny-answer-aliases" is in use may trigger an assert leading to a denial of service↗2018-08-08
▶
Bugzilla
CVE-2018-5740 bind99: bind: processing of certain records when "deny-answer-aliases" is in use may trigger an assert leading to a denial of service [fedora-all]↗2018-08-08
▶
CVE-2018-5740 (HIGH CVSS 7.5) | "deny-answer-aliases" is a little-u | cvebase.io