CVE-2018-5741: Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

Published Sep 19, 2018
·
Updated

ISC BIND before releases 9.11.4-P2 and 9.12.2-P2 does not properly document the behaviour of the krb5-subdomain and ms-subdomain update policies. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were.

The krb5-subdomain and ms-subdomain update policy rule types permit updates from any client authenticated with a valid Kerberos or Windows machine principal from the REALM specified in the identity field, to modify records in the zone at or below the name specified in the name field. The incorrect documentation, however, indicated that the policy would be restricted to names at or below the machine's name as encoded in the Windows or Kebreros principal.

External Reference:

https://kb.isc.org/docs/cve-2018-5741

Other sources

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

MITRE

Affected Software

5 affected componentsFixes available
redhat/bind<9.11.4
9.11.4
redhat/bind<9.12.2
9.12.2
redhat/bind<9.13.3
9.13.3
ISC BIND<9.11.5
ISC BIND>=9.12.0<9.12.3

Remediation

Information

At the time of public disclosure, ISC is not providing any code changing the behavior of the update-policy feature. While we believe that there are a few operators out there who are relying on the strictest interpretation permitted by the erroneous documentation, we have to balance that against changing the behavior of features in stable branches of BIND, including the 9.11 branch which is meant to be a feature-complete Extended Support Version of BIND 9. As a compromise between these conflicting priorities, we have decided that our best course of action is to disclose the error but leave the existing behavior of the krb5-subdomain and ms-subdomain policies as they are (while correcting the erroneous documentation). In maintenance releases issued during or after October 2018, the name field for ms-subdomain and krb5-subdomain will be corrected so that names lower than "." can be configured, and two new rule types will be added, krb5-selfsub and ms-selfsub, analogous to the existing selfsub rule type, which implement the behavior that was formerly described in the documentation for krb5-subdomain and ms-subdomain: restricting updates to names at or below the machine name encoded in the client's Windows or Kerberos principal.

Event History

Jan 16, 2019
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
RemedyDescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2018-5741?

The severity of CVE-2018-5741 is medium, with a severity value of 6.5.

2

How does CVE-2018-5741 affect BIND?

CVE-2018-5741 affects BIND versions 9.11.5 up to 9.12.3.

3

What is the update-policy feature in BIND?

The update-policy feature in BIND provides fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone.

4

How can I limit the types of updates performed by a client in BIND?

You can use the update-policy feature in BIND to configure various rules that limit the types of updates that can be performed by a client, depending on the key used when sending the update.

5

Where can I find more information about CVE-2018-5741?

You can find more information about CVE-2018-5741 at the following references: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html, http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html, and http://www.securityfocus.com/bid/105379.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203