CVE-2018-5740: A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.
Other sources
BIND through versions 9.8.8, 9.9.13, 9.10.8, 9.11.4, 9.12.2 and 9.13.2 have a flaw in the "deny-answer-aliases" feature that can cause an INSIST assertion failure in named. A remote attacker could exploit this to cause named to crash.
Only servers which have explicitly enabled the "deny-answer-aliases" feature are at risk and disabling the feature prevents exploitation.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bind9to a version that resolves this vulnerability.Fixed in 1:9.16.50-1~deb11u2Fixed in 1:9.16.50-1~deb11u4Fixed in 1:9.18.41-1~deb12u1Fixed in 1:9.18.44-1~deb12u1Fixed in 1:9.20.15-1~deb13u1Fixed in 1:9.20.18-1~deb13u1Fixed in 1:9.20.19-1 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.9.13 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.10.8 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.11.4 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.12.2 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.11.3 - Upgrade
Upgrade
BINDto a version that resolves this vulnerability.Fixed in 9.9.13-P1 - Upgrade
Upgrade
BINDto a version that resolves this vulnerability.Fixed in 9.10.8-P1 - Upgrade
Upgrade
BINDto a version that resolves this vulnerability.Fixed in 9.11.3-S3 - Upgrade
Upgrade
BINDto a version that resolves this vulnerability.Fixed in 9.11.4-P1 - Upgrade
Upgrade
BINDto a version that resolves this vulnerability.Fixed in 9.12.2-P1 - Configuration
Disable use of the "deny-answer-aliases" feature; it is off by default and only explicitly enabled configurations are affected.
BIND named deny-answer-aliases = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5740?
CVE-2018-5740 is classified as having a medium severity due to its potential impact on DNS rebinding attacks.
How do I fix CVE-2018-5740?
To fix CVE-2018-5740, it is recommended to upgrade to BIND version 9.9.13 or later, or the fixed versions provided by your Linux distribution.
What systems are affected by CVE-2018-5740?
CVE-2018-5740 affects various versions of the BIND DNS software, specifically versions before 9.9.13, 9.10.8, 9.11.4, and 9.12.2.
Is CVE-2018-5740 specific to certain Linux distributions?
Yes, CVE-2018-5740 affects BIND installations on different Linux distributions including Red Hat and Debian.
What are the potential risks of CVE-2018-5740?
The main risk associated with CVE-2018-5740 is the exposure to DNS rebinding attacks which could allow attackers to compromise user privacy and data.