CVE-2018-5744: A specially crafted packet can cause named to leak memory
First published: Wed Oct 09 2019(Updated: )
A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.
Credit: security-officer@isc.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ISC BIND | >=9.10.7<9.10.8 | |
| ISC BIND | >=9.11.3<9.11.5 | |
| ISC BIND | >=9.12.0<9.12.3 | |
| ISC BIND | >=9.13.0<9.13.6 | |
| ISC BIND | =9.10.7-s1 | |
| ISC BIND | =9.10.8 | |
| ISC BIND | =9.10.8-p1 | |
| ISC BIND | =9.10.8-rc1 | |
| ISC BIND | =9.10.8-rc2 | |
| ISC BIND | =9.11.5 | |
| ISC BIND | =9.11.5-p1 | |
| ISC BIND | =9.11.5-rc1 | |
| ISC BIND | =9.11.5-s3 | |
| ISC BIND | =9.12.3 | |
| ISC BIND | =9.12.3-p1 | |
| ISC BIND | =9.12.3-rc1 |
Remedy
Upgrade to a version of BIND containing a fix for the memory leak. >= BIND 9.11.5-P4 >= BIND 9.12.3-P4
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-5744.
What is the severity of CVE-2018-5744?
The severity of CVE-2018-5744 is high.
Which versions of BIND are affected by CVE-2018-5744?
Versions 9.10.7 to 9.10.8-P1, 9.11.3 to 9.11.5-P1, 9.12.0 to 9.12.3-P1, and 9.10.7-S1 to 9.11.5-S3 of BIND 9 Supported Preview Edition are affected by CVE-2018-5744.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for CVE-2018-5744 is 772.
How can I fix CVE-2018-5744?
To fix CVE-2018-5744, it is recommended to upgrade BIND to a patched version provided by ISC.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/title
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/source
- vendor/isc
- canonical/isc bind
- version/isc bind/9.10.7
- version/isc bind/9.11.3
- version/isc bind/9.12.0
- version/isc bind/9.13.0
- version/isc bind/9.10.7-s1
- version/isc bind/9.10.8
- version/isc bind/9.10.8-p1
- version/isc bind/9.10.8-rc1
- version/isc bind/9.10.8-rc2
- version/isc bind/9.11.5
- version/isc bind/9.11.5-p1
- version/isc bind/9.11.5-rc1
- version/isc bind/9.11.5-s3
- version/isc bind/9.12.3
- version/isc bind/9.12.3-p1
- version/isc bind/9.12.3-rc1