CVE-2018-5737: BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.
First published: Fri May 18 2018(Updated: )
A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could cause operational problems depending on the particular manifestation -- either degradation or denial of service. Affects BIND 9.12.0 and 9.12.1.
Credit: security-officer@isc.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ISC BIND | =9.12.0 | |
| ISC BIND | =9.12.1 | |
| Netapp Cloud Backup | ||
| Netapp Data Ontap Edge |
Remedy
The error which can be exploited in this vulnerability is present in only two public release versions of BIND, 9.12.0 and 9.12.1. If you are running an affected version then upgrade to BIND 9.12.1-P2
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-5737?
The severity of CVE-2018-5737 is high with a score of 7.5.
Which software versions are affected by CVE-2018-5737?
ISC BIND versions 9.12.0 and 9.12.1, Netapp Cloud Backup, and Apple macOS Mojave with Data ONTAP Edge are affected by CVE-2018-5737.
What is the problem with the implementation of the serve-stale feature in BIND 9.12?
The implementation of the serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off.
What can cause undesired behavior in the serve-stale feature of BIND 9.12?
The serve-stale feature of BIND 9.12 can have problematic interaction with NSEC aggressive negative caching, which can in some cases cause undesired behavior.
Are there any references I can check for more information on CVE-2018-5737?
Yes, you can check the following references for more information: SecurityFocus (http://www.securityfocus.com/bid/104236), SecurityTracker (http://www.securitytracker.com/id/1040942), ISC Knowledge Base (https://kb.isc.org/docs/aa-01606).
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/isc
- canonical/isc bind
- version/isc bind/9.12.0
- version/isc bind/9.12.1
- vendor/netapp
- canonical/netapp cloud backup
- canonical/netapp data ontap edge