CVE-2018-5737
Summary
| CVE | CVE-2018-5737 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-01-16 20:29:00 UTC |
| Updated | 2019-10-09 23:41:00 UTC |
| Description | A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could cause operational problems depending on the particular manifestation -- either degradation or denial of service. Affects BIND 9.12.0 and 9.12.1. |
Risk And Classification
Problem Types: CWE-617
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Isc | Bind | 9.12.0 | All | All | All |
| Application | Isc | Bind | 9.12.1 | All | All | All |
| Application | Isc | Bind | 9.12.0 | All | All | All |
| Application | Isc | Bind | 9.12.1 | All | All | All |
| Application | Netapp | Cloud Backup | - | All | All | All |
| Application | Netapp | Cloud Backup | - | All | All | All |
| Application | Netapp | Data Ontap Edge | - | All | All | All |
| Application | Netapp | Data Ontap Edge | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| ISC BIND CVE-2018-5737 Remote Denial of Service Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| May 2018 ISC BIND Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| Security Advisories-CVE-2018-5737: BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled. | CONFIRM | kb.isc.org | Vendor Advisory |
| BIND Flaw in serve-stale Function Lets Remote Users Deny Service - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: ISC would like to thank Tony Finch of the University of Cambridge for his assistance in discovering and analyzing this vulnerability.