An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after failing the assertion test. Affects BIND 9.12.0 and 9.12.1.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An error in zone database reference counting can lead to an assertion failure if a server which is running
    an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect
    could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate
    zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after
    failing the assertion test. Affects BIND 9.12.0 and 9.12.1. (CVE-2018-5736)

  - A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion
    failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between
    the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior
    from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could
    cause operational problems depending on the particular manifestation -- either degradation or denial of
    service. Affects BIND 9.12.0 and 9.12.1. (CVE-2018-5737)

According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.12.0 or 9.12.1.  It is, therefore, affected by an assertion failure vulnerability which exists in the zone database reference counting mechanism due to attempting several transfers of a slave zone in quick succession.

An unauthenticated, remote attacker can exploit this to cause the named process to exit after failing the assertion test.

The version of ISC BIND running on the remote name server is 9.12.x prior to 9.12.1-P2. It is, therefore, affected by multiple vulnerabilities.

ISC reports :

An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession.

A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging.

ID	Name	Product	Family	Severity
423736	Alpine: multiple bind packages: security update to 9.12.1_p2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423736	Alpine: multiple bind packages: security update to 9.12.1_p2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
122238	ISC BIND Assertion Failure Vulnerability (DoS)	Nessus	DNS	medium
109947	ISC BIND 9.12.x < 9.12.1-P1 Multiple Vulnerabilities	Nessus	DNS	high
109929	FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-5736

medium

Tenable Plugins

high

high

medium

high

high