CVE-2018-5738
Summary
| CVE | CVE-2018-5738 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-01-16 20:29:00 UTC |
| Updated | 2019-08-30 17:15:00 UTC |
| Description | Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the "allow-recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;" (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition. |
Risk And Classification
Problem Types: CWE-200
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Application | Isc | Bind | 9.10.7 | All | All | All |
| Application | Isc | Bind | 9.10.7 | s1 | All | All |
| Application | Isc | Bind | 9.11.3 | All | All | All |
| Application | Isc | Bind | 9.11.3 | s1 | All | All |
| Application | Isc | Bind | 9.11.3 | s2 | All | All |
| Application | Isc | Bind | 9.12.0 | All | All | All |
| Application | Isc | Bind | 9.12.0 | a1 | All | All |
| Application | Isc | Bind | 9.12.0 | b1 | All | All |
| Application | Isc | Bind | 9.12.0 | b2 | All | All |
| Application | Isc | Bind | 9.12.0 | rc1 | All | All |
| Application | Isc | Bind | 9.12.0 | rc3 | All | All |
| Application | Isc | Bind | 9.12.1 | All | All | All |
| Application | Isc | Bind | 9.12.1 | p1 | All | All |
| Application | Isc | Bind | 9.12.1 | p2 | All | All |
| Application | Isc | Bind | 9.13.0 | All | All | All |
| Application | Isc | Bind | 9.9.12 | All | All | All |
| Application | Isc | Bind | 9.9.12 | s1 | All | All |
| Application | Isc | Bind | 9.10.7 | All | All | All |
| Application | Isc | Bind | 9.10.7 | s1 | All | All |
| Application | Isc | Bind | 9.11.3 | All | All | All |
| Application | Isc | Bind | 9.11.3 | s1 | All | All |
| Application | Isc | Bind | 9.11.3 | s2 | All | All |
| Application | Isc | Bind | 9.12.0 | All | All | All |
| Application | Isc | Bind | 9.12.0 | a1 | All | All |
| Application | Isc | Bind | 9.12.0 | b1 | All | All |
| Application | Isc | Bind | 9.12.0 | b2 | All | All |
| Application | Isc | Bind | 9.12.0 | rc1 | All | All |
| Application | Isc | Bind | 9.12.0 | rc3 | All | All |
| Application | Isc | Bind | 9.12.1 | All | All | All |
| Application | Isc | Bind | 9.12.1 | p1 | All | All |
| Application | Isc | Bind | 9.12.1 | p2 | All | All |
| Application | Isc | Bind | 9.13.0 | All | All | All |
| Application | Isc | Bind | 9.9.12 | All | All | All |
| Application | Isc | Bind | 9.9.12 | s1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2018-5738: Some versions of BIND can improperly permit recursive query service to unauthorized clients - Security Advisories | CONFIRM | kb.isc.org | Mitigation, Vendor Advisory |
| BIND: Multiple vulnerabilities (GLSA 201903-13) — Gentoo security | GENTOO | security.gentoo.org | Third Party Advisory |
| USN-3683-1: Bind vulnerability | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| BIND Recursion Access Control Flaw Lets Remote Users Obtain Potentially Sensitive Information About Previous Nameserver Queries - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| CVE-2018-5738 ISC BIND Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: ISC would like to thank Andrew Skalski for reporting this issue.