Detections
Analytics

Alpine: multiple bind packages: security update to 9.12.1_p2-r0

high Tenable Cloud Security Plugin ID 423736

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - An error in zone database reference counting can lead to an assertion failure if a server which is running
 an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect
 could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate
 zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after
 failing the assertion test. Affects BIND 9.12.0 and 9.12.1. (CVE-2018-5736)

 - A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion
 failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between
 the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior
 from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could
 cause operational problems depending on the particular manifestation -- either degradation or denial of
 service. Affects BIND 9.12.0 and 9.12.1. (CVE-2018-5737)

See Also

https://security.alpinelinux.org/vuln/CVE-2018-5736

https://security.alpinelinux.org/vuln/CVE-2018-5737

Plugin Details

Severity: High

ID: 423736

Version: Revision 1.7

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2018-5737

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/18/2018

Reference Information

CVE: CVE-2018-5736, CVE-2018-5737

BID: 104236, 104386

IAVA: 2018-A-0163-S