Vulnerability CVE-2018-5740: Information

Description

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-5740
Published: Jan. 16, 2019
Modified: April 12, 2022
Error type identifier: CWE-617

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
bindsisyphus9.11.4.P1-alt19.18.26-alt1ALT-PU-2018-2141-1211328Fixed
bindp109.11.4.P1-alt19.16.48-alt1ALT-PU-2018-2141-1211328Fixed
bindp99.11.4.P1-alt19.11.37-alt1ALT-PU-2018-2141-1211328Fixed
bindp89.10.8.P1-alt19.10.8.P1-alt4ALT-PU-2019-2541-1236400Fixed
bindc10f19.11.4.P1-alt19.16.48-alt0.c10f2.1ALT-PU-2018-2141-1211328Fixed
bindc9f29.11.4.P1-alt19.11.37-alt1ALT-PU-2018-2141-1211328Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://kb.isc.org/docs/aa-01639
  • Vendor Advisory
USN-3769-2
  • Third Party Advisory
USN-3769-1
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20180926-0003/
  • Third Party Advisory
[debian-lts-announce] 20180830 [SECURITY] [DLA 1485-1] bind9 security update
  • Third Party Advisory
RHSA-2018:2571
  • Third Party Advisory
RHSA-2018:2570
  • Third Party Advisory
1041436
  • Third Party Advisory
  • VDB Entry
105055
  • VDB Entry
  • Third Party Advisory
GLSA-201903-13
  • Third Party Advisory
openSUSE-SU-2019:1533
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:1532
  • Mailing List
  • Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us
  • Third Party Advisory
[debian-lts-announce] 20211102 [SECURITY] [DLA 2807-1] bind9 security update
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
      Start including
      9.7.0
      End excliding
      9.8.8
      cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
      Start including
      9.9.0
      End excliding
      9.9.13
      cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
      Start including
      9.10.0
      End excliding
      9.10.8
      cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
      Start including
      9.11.0
      End excliding
      9.11.4
      cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
      Start including
      9.12.0
      End excliding
      9.12.2
      cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
      Start including
      9.13.0
      End excliding
      9.13.2

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*

      Configuration 5

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

      Configuration 6

      cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*

      Configuration 7

      cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
      cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
      cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top