CVE-2018-5737: BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.
A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could cause operational problems depending on the particular manifestation -- either degradation or denial of service. Affects BIND 9.12.0 and 9.12.1.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5737?
The severity of CVE-2018-5737 is high with a score of 7.5.
Which software versions are affected by CVE-2018-5737?
ISC BIND versions 9.12.0 and 9.12.1, Netapp Cloud Backup, and Apple macOS Mojave with Data ONTAP Edge are affected by CVE-2018-5737.
What is the problem with the implementation of the serve-stale feature in BIND 9.12?
The implementation of the serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off.
What can cause undesired behavior in the serve-stale feature of BIND 9.12?
The serve-stale feature of BIND 9.12 can have problematic interaction with NSEC aggressive negative caching, which can in some cases cause undesired behavior.
Are there any references I can check for more information on CVE-2018-5737?
Yes, you can check the following references for more information: SecurityFocus (http://www.securityfocus.com/bid/104236), SecurityTracker (http://www.securitytracker.com/id/1040942), ISC Knowledge Base (https://kb.isc.org/docs/aa-01606).