CVE-2018-5740

Published: Jan 16, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

Affected (26)

Products: Isc: Bind · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation · Debian: Debian Linux · +4 more

Show all products

Isc: Bind · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation · Debian: Debian Linux · Netapp: Data Ontap Edge · Canonical: Ubuntu Linux · Hp: Hp Ux · Opensuse: Leap

1 product

5 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

1 product

1 product

Data Ontap Edge

1 product

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	From 9.10.0 to 9.10.8
Isc Bind	From 9.11.0 to 9.11.4
Isc Bind	From 9.12.0 to 9.12.2
Isc Bind	From 9.13.0 to 9.13.2
Isc Bind	From 9.7.0 to 9.8.8
Isc Bind	From 9.9.0 to 9.9.13

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Eus	Version 7.5
Redhat Enterprise Linux Server Eus	Version 7.6
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Data Ontap Edge	All versions

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Hp Hp Ux	All versions

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1
Opensuse Leap	Version 42.3

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (28)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00026.html

Source: security-officer@isc.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00027.html

Source: security-officer@isc.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/105055

Source: security-officer@isc.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041436

Source: security-officer@isc.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:2570

Source: security-officer@isc.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2571

Source: security-officer@isc.org

Third Party Advisory

https://kb.isc.org/docs/aa-01639

Source: security-officer@isc.org

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2018/08/msg00033.html

Source: security-officer@isc.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html

Source: security-officer@isc.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201903-13

Source: security-officer@isc.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180926-0003/

Source: security-officer@isc.org

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us

Source: security-officer@isc.org

Third Party Advisory

https://usn.ubuntu.com/3769-1/

Source: security-officer@isc.org

Third Party Advisory

https://usn.ubuntu.com/3769-2/

Source: security-officer@isc.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00026.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/105055

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041436

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:2570

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2571

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://kb.isc.org/docs/aa-01639

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2018/08/msg00033.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201903-13

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180926-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3769-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3769-2/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.