A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A failure to free memory can occur when processing messages having a specific combination of EDNS options.
    Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions
    9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13
    development branch are also affected. (CVE-2018-5744)

  - "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust
    anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys
    feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if,
    during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm.
    Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions
    9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13
    development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for
    vulnerability to CVE-2018-5745. (CVE-2018-5745)

  - Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones
    are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and
    versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13
    development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for
    vulnerability to CVE-2019-6465. (CVE-2019-6465)

The remote NewStart CGSL host, running version MAIN 6.02, has bind packages installed that are affected by multiple vulnerabilities:

  - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when     answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for     remote attackers to guess the next query id and perform DNS cache poisoning. (CVE-2007-2926)

  - Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions,     which allows local users to perform unauthorized named commands, such as causing a denial of service by     stopping named. (CVE-2007-6283)

  - Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in     FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
    (CVE-2008-0122)

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

  - BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL     DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a     malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. (CVE-2009-0025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued
    after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The
    intended (and documented) behavior is that if an operator has not specified a value for the "allow-
    recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in
    named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;"
    (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query"
    (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of
    "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly
    set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change
    #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-
    query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from
    the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12,
    9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1,
    9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition. (CVE-2018-5738)

  - A failure to free memory can occur when processing messages having a specific combination of EDNS options.
    Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions
    9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13
    development branch are also affected. (CVE-2018-5744)

  - "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust
    anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys
    feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if,
    during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm.
    Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions
    9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13
    development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for
    vulnerability to CVE-2018-5745. (CVE-2018-5745)

  - Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones
    are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and
    versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13
    development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for
    vulnerability to CVE-2019-6465. (CVE-2019-6465)

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A race condition leading to denial of service was found     in the way bind handled certain malformed packets. A     remote attacker who could cause the bind resolver to     perform queries on a server, which responds     deliberately with malformed answers, could cause named     to exit.(CVE-2019-6471)

  - A failure to free memory can occur when processing     messages having a specific combination of EDNS options.
    Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3
    -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions     9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview     Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected.(CVE-2018-5744)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A failure to free memory can occur when processing     messages having a specific combination of EDNS options.
    Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3
    -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions     9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview     Edition. Versions 9.13.0 -> 9.13.6 of the 9.13     development branch are also affected.(CVE-2018-5744)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition.
Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. (CVE-2018-5744)

Impact

BIG-IP

Attacker can exploit this vulnerability to cause memory exhaustion on the affected system.

BIG-IQ, F5 iWorkflow, Enterprise Manager, and Traffix SDC

There is no impact for these F5 products; theyare not affected by this vulnerability.

According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is less than 9.11.5-P4 / 9.11.5-S5 / 9.12.3-P4 / 9.13.7.  It is, therefore, affected by a denial of service vulnerability.

  - A memory leak vulnerability exists for named's memory use. An     unauthenticated, remote attacker can cause named's memory use to     grow without bounds until all memory available to the process is     exhausted. (CVE-2018-5744)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

More details are in [upstream release notes](https://ftp.isc.org/isc/bind9/9.11.5-P4/RELEASE-NOTES-bind-9.11 .5-P4.html). Disabled autodetected support of ED448, it does not work.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3893-1 advisory.

    Toshifumi Sakaguchi discovered that Bind incorrectly handled memory. A remote attacker could possibly use     this issue to cause Bind to consume resources, leading to a denial of service. This issue only affected     Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-5744)

    It was discovered that Bind incorrectly handled certain trust anchors when used with the managed-keys     feature. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of     service. (CVE-2018-5745)

    It was discovered that Bind incorrectly handled certain controls for zone transfers, contrary to     expectations. (CVE-2019-6465)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423698	Alpine: multiple bind packages: security update to 9.12.3_p4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423698	Alpine: multiple bind packages: security update to 9.12.3_p4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
206846	NewStart CGSL MAIN 6.02 : bind Multiple Vulnerabilities (NS-SA-2024-0060)	Nessus	NewStart CGSL Local Security Checks	medium
203761	Photon OS 3.0: Bindutils PHSA-2020-3.0-0049	Nessus	PhotonOS Local Security Checks	medium
403644	Alpine: bind: security update to 9.11.5_p4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403644	Alpine: bind: security update to 9.11.5_p4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400531	Alpine: multiple bind packages: security update to 9.12.3-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400531	Alpine: multiple bind packages: security update to 9.12.3-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
132801	EulerOS Virtualization for ARM 64 3.0.5.0 : bind (EulerOS-SA-2020-1047)	Nessus	Huawei Local Security Checks	high
131341	EulerOS 2.0 SP8 : bind (EulerOS-SA-2019-2275)	Nessus	Huawei Local Security Checks	high
122552	F5 Networks BIG-IP : BIND vulnerability (K00040234)	Nessus	F5 Networks Local Security Checks	high
122505	ISC BIND Memory Leak DoS Vulnerability	Nessus	DNS	high
122438	Fedora 29 : 32:bind (2019-5396a60397)	Nessus	Fedora Local Security Checks	high
122399	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Bind vulnerabilities (USN-3893-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2018-5744

high

Tenable Plugins

medium

medium

medium

medium

high

high

medium

medium

high

high

high

high

high

medium