A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could cause operational problems depending on the particular manifestation -- either degradation or denial of service. Affects BIND 9.12.0 and 9.12.1.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An error in zone database reference counting can lead to an assertion failure if a server which is running
    an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect
    could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate
    zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after
    failing the assertion test. Affects BIND 9.12.0 and 9.12.1. (CVE-2018-5736)

  - A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion
    failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between
    the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior
    from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could
    cause operational problems depending on the particular manifestation -- either degradation or denial of
    service. Affects BIND 9.12.0 and 9.12.1. (CVE-2018-5737)

According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.12.0 or 9.12.1.  It is, therefore, affected by an assertion failure vulnerability which exists in the rbtdb.c due to the implementation of the new serve-stale feature and NSEC aggressive negative caching.

An unauthenticated, remote attacker can exploit this to cause undesirable behavior such as recurision looping or excessive logging, resulting in a degradation or denial of service.

The version of ISC BIND running on the remote name server is 9.12.x prior to 9.12.1-P2. It is, therefore, affected by multiple vulnerabilities.

ISC reports :

An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession.

A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging.

ID	Name	Product	Family	Severity
423736	Alpine: multiple bind packages: security update to 9.12.1_p2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423736	Alpine: multiple bind packages: security update to 9.12.1_p2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
122239	ISC BIND Assertion Failure Vulnerability (DoS)	Nessus	DNS	high
109947	ISC BIND 9.12.x < 9.12.1-P1 Multiple Vulnerabilities	Nessus	DNS	high
109929	FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-5737

high

Tenable Plugins

high

high

high

high

high