CVE-2018-5740high

CVE-2018-5740: high-severity vulnerability in ISC BIND 9

A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

Published · Updated

Follow this CVE+ Monitor BIND+ Monitor bind9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 60%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Enterprise Linux 5
workaround: Disabling the "deny-answer-aliases" configuration option should prevent exploitation.
Fixed
18 products (304 components)
Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) · Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) · Red Hat Enterprise Linux Server (v. 6) · and others 13
fix ↗
Not affected
3 products (20 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 5 · Red Hat Virtualization 4
In short

A bug in BIND's "deny-answer-aliases" security feature causes the DNS server to crash unexpectedly. This feature is designed to protect users from DNS rebinding attacks, but the flaw makes it unstable when enabled.

Technical detail

The "deny-answer-aliases" feature in BIND contains a logic defect that triggers an assertion failure in name.c, causing denial of service. An attacker can craft DNS queries to exploit this flaw when the feature is active, resulting in server crash. Affects BIND 9.7.0–9.8.8, 9.9.0–9.9.13, 9.10.0–9.10.8, 9.11.0–9.11.4, 9.12.0–9.12.2, and 9.13.0–9.13.2.

Summary generated and translated by AI from the official description.
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
ISC · BIND 9
Related CVEs — ISC BIND 9

In the same product, most dangerous first.

CVE-2022-3736HIGHnamed configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesEPSS 48.4%CVE-2017-3145HIGHImproper fetch cleanup sequencing in the resolver can cause named to crashEPSS 27.7%CVE-2022-3488HIGHnamed may terminate unexpectedly when processing ECS options in repeated responses to iterative queriesEPSS 19.0%CVE-2024-12705HIGHDNS-over-HTTPS implementation suffers from multiple issues under heavy query loadEPSS 18.2%CVE-2017-3143HIGHAn error in TSIG authentication can permit unauthorized dynamic updatesEPSS 18.2%CVE-2017-3135HIGHCombination of DNS64 and RPZ Can Lead to CrashEPSS 17.1%