csaf_certbund - wid-sec-w-2025-1194

WID-SEC-W-2025-1194

Vulnerability from csaf_certbund - Published: 2019-02-21 23:00 - Updated: 2025-05-29 22:00

Summary

Internet Systems Consortium BIND: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

BIND (Berkeley Internet Name Domain) ist ein Open-Source-Softwarepaket, das einen Domain-Name-System-Server implementiert.

Angriff

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.

Betroffene Betriebssysteme

- Linux - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "BIND (Berkeley Internet Name Domain) ist ein Open-Source-Softwarepaket, das einen Domain-Name-System-Server implementiert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1194 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2025-1194.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1194 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1194"
      },
      {
        "category": "external",
        "summary": "Eintrag in der OSS Mailing Liste vom 2019-02-21",
        "url": "https://seclists.org/oss-sec/2019/q1/146"
      },
      {
        "category": "external",
        "summary": "ISC Security Advisories vom 2019-02-21",
        "url": "https://kb.isc.org/docs/cve-2018-5744"
      },
      {
        "category": "external",
        "summary": "ISC Security Advisories vom 2019-02-21",
        "url": "https://kb.isc.org/docs/cve-2018-5745"
      },
      {
        "category": "external",
        "summary": "ISC Security Advisories vom 2019-02-21",
        "url": "https://kb.isc.org/docs/CVE-2019-6465"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-3893-1 vom 2019-02-22",
        "url": "https://usn.ubuntu.com/3893-1/"
      },
      {
        "category": "external",
        "summary": "Arch Linux Security Advisory ASA-201902-25 vom 2019-02-25",
        "url": "https://security.archlinux.org/ASA-201902-25"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-3893-2 vom 2019-02-25",
        "url": "https://usn.ubuntu.com/3893-2/"
      },
      {
        "category": "external",
        "summary": "Release Notes for BIND Version 9.12.4 Stand 2019-03-01",
        "url": "https://ftp.isc.org/isc/bind9/9.12.4/RELEASE-NOTES-bind-9.12.4.html"
      },
      {
        "category": "external",
        "summary": "Release Notes for BIND Version 9.11.6 Stand 2019-03-01",
        "url": "https://ftp.isc.org/isc/bind9/9.11.6/RELEASE-NOTES-bind-9.11.6.html"
      },
      {
        "category": "external",
        "summary": "F5 Security Advisory K00040234 vom 2019-04-12",
        "url": "https://support.f5.com/csp/article/K00040234"
      },
      {
        "category": "external",
        "summary": "F5 Security Advisory K01713115 vom 2019-05-01",
        "url": "https://support.f5.com/csp/article/K01713115"
      },
      {
        "category": "external",
        "summary": "F5 Security Advisory K25244852 vom 2019-05-01",
        "url": "https://support.f5.com/csp/article/K25244852"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-4440 vom 2019-05-10",
        "url": "http://www.debian.org/security/2019/dsa-4440"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2019:1407-1 vom 2019-06-04",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191407-1.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2019:14074-1 vom 2019-06-07",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914074-1.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2019:1449-1 vom 2019-06-07",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191449-1.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2019:1406-2 vom 2019-06-11",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191406-2.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2019:2502-1 vom 2019-10-01",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192502-1.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2019:3552 vom 2019-11-05",
        "url": "https://access.redhat.com/errata/RHSA-2019:3552"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2020:1061 vom 2020-03-31",
        "url": "https://access.redhat.com/errata/RHSA-2020:1061"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2020:1277 vom 2020-04-08",
        "url": "https://access.redhat.com/errata/RHSA-2020:1277"
      },
      {
        "category": "external",
        "summary": "AVAYA Security Advisory ASA-2020-059 vom 2020-07-19",
        "url": "https://downloads.avaya.com/css/P8/documents/101069466"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2025-213 vom 2025-05-30",
        "url": "https://www.dell.com/support/kbdoc/de-de/000326299/dsa-2025-213-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-multiple-third-party-vulnerabilities"
      }
    ],
    "source_lang": "en-US",
    "title": "Internet Systems Consortium BIND: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-05-29T22:00:00.000+00:00",
      "generator": {
        "date": "2025-05-30T10:55:10.186+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2025-1194",
      "initial_release_date": "2019-02-21T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2019-02-21T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2019-02-21T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2019-02-24T23:00:00.000+00:00",
          "number": "3",
          "summary": "BSI Bewertung angepasst."
        },
        {
          "date": "2019-02-24T23:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: FEDORA-2019-86412405D5, FEDORA-2019-5396A60397"
        },
        {
          "date": "2019-02-24T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Arch Linux aufgenommen"
        },
        {
          "date": "2019-02-25T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2019-02-28T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2019-02-28T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2019-04-14T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von F5 aufgenommen"
        },
        {
          "date": "2019-05-01T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von F5 aufgenommen"
        },
        {
          "date": "2019-05-09T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2019-06-03T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2019-06-06T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2019-06-10T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2019-06-11T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2019-10-01T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2019-11-05T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2020-03-31T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2020-04-07T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2020-07-19T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von AVAYA aufgenommen"
        },
        {
          "date": "2025-05-29T22:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Dell aufgenommen"
        }
      ],
      "status": "final",
      "version": "21"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Avaya Aura Application Enablement Services",
            "product": {
              "name": "Avaya Aura Application Enablement Services",
              "product_id": "T015516",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_application_enablement_services:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Communication Manager",
            "product": {
              "name": "Avaya Aura Communication Manager",
              "product_id": "T015126",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:communication_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Device Services",
            "product": {
              "name": "Avaya Aura Device Services",
              "product_id": "T015517",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_device_services:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Session Manager",
            "product": {
              "name": "Avaya Aura Session Manager",
              "product_id": "T015127",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:session_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura System Manager",
            "product": {
              "name": "Avaya Aura System Manager",
              "product_id": "T015518",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_system_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Utility Services",
            "product": {
              "name": "Avaya Aura Utility Services",
              "product_id": "T015824",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_utility_services:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Breeze Platform",
            "product": {
              "name": "Avaya Breeze Platform",
              "product_id": "T015823",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:breeze_platform:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya CMS",
            "product": {
              "name": "Avaya CMS",
              "product_id": "997",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:call_management_system_server:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Session Border Controller",
            "product": {
              "name": "Avaya Session Border Controller",
              "product_id": "T015520",
              "product_identification_helper": {
                "cpe": "cpe:/h:avaya:session_border_controller:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Web License Manager",
            "product": {
              "name": "Avaya Web License Manager",
              "product_id": "T016243",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:web_license_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Avaya"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell Avamar",
            "product": {
              "name": "Dell Avamar",
              "product_id": "T039664",
              "product_identification_helper": {
                "cpe": "cpe:/a:dell:avamar:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Dell NetWorker",
            "product": {
              "name": "Dell NetWorker",
              "product_id": "T034583",
              "product_identification_helper": {
                "cpe": "cpe:/a:dell:networker:virtual"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.11.5-P4",
                "product": {
                  "name": "Internet Systems Consortium BIND \u003c9.11.5-P4",
                  "product_id": "T013636"
                }
              },
              {
                "category": "product_version",
                "name": "9.11.5-P4",
                "product": {
                  "name": "Internet Systems Consortium BIND 9.11.5-P4",
                  "product_id": "T013636-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:isc:bind:9.11.5-p4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.12.3-P4",
                "product": {
                  "name": "Internet Systems Consortium BIND \u003c9.12.3-P4",
                  "product_id": "T013637"
                }
              },
              {
                "category": "product_version",
                "name": "9.12.3-P4",
                "product": {
                  "name": "Internet Systems Consortium BIND 9.12.3-P4",
                  "product_id": "T013637-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:isc:bind:9.12.3-p4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.11.5-S5",
                "product": {
                  "name": "Internet Systems Consortium BIND \u003c9.11.5-S5",
                  "product_id": "T013638"
                }
              },
              {
                "category": "product_version",
                "name": "9.11.5-S5",
                "product": {
                  "name": "Internet Systems Consortium BIND 9.11.5-S5",
                  "product_id": "T013638-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:isc:bind:9.11.5-s5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "BIND"
          }
        ],
        "category": "vendor",
        "name": "Internet Systems Consortium"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-5744",
      "product_status": {
        "known_affected": [
          "T013637",
          "T015518",
          "T013638",
          "T015517",
          "67646",
          "T015516",
          "T015824",
          "T013636",
          "T015823",
          "T034583",
          "T015127",
          "T015126",
          "T015520",
          "T016243",
          "T039664",
          "2951",
          "T002207",
          "T000126",
          "997"
        ]
      },
      "release_date": "2019-02-21T23:00:00.000+00:00",
      "title": "CVE-2018-5744"
    },
    {
      "cve": "CVE-2018-5745",
      "product_status": {
        "known_affected": [
          "T013637",
          "T013638",
          "2951",
          "T002207",
          "67646",
          "T013636",
          "T000126",
          "T034583",
          "T039664"
        ]
      },
      "release_date": "2019-02-21T23:00:00.000+00:00",
      "title": "CVE-2018-5745"
    },
    {
      "cve": "CVE-2019-6465",
      "product_status": {
        "known_affected": [
          "T013637",
          "T013638",
          "2951",
          "T002207",
          "67646",
          "T013636",
          "T000126",
          "T034583",
          "T039664"
        ]
      },
      "release_date": "2019-02-21T23:00:00.000+00:00",
      "title": "CVE-2019-6465"
    }
  ]
}

CVE-2019-6465 (GCVE-0-2019-6465)

Vulnerability from cvelistv5 – Published: 2019-10-09 14:17 – Updated: 2024-09-16 20:37

Summary

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

A client exercising this defect can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL.

Assigner

isc

References

URL

Tags

	https://kb.isc.org/docs/cve-2019-6465	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2019:3552	vendor-advisoryx_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	ISC	BIND 9	Affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:23:21.004Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.isc.org/docs/cve-2019-6465"
          },
          {
            "name": "RHSA-2019:3552",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3552"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIND 9",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P2, 9.12.0 -\u003e 9.12.3-P2, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465."
            }
          ]
        }
      ],
      "datePublic": "2019-02-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P2, 9.12.0 -\u003e 9.12.3-P2, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A client exercising this defect can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-06T00:07:01",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.isc.org/docs/cve-2019-6465"
        },
        {
          "name": "RHSA-2019:3552",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3552"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to the patched release most closely related to your current version of BIND:\n\n\u003e=    BIND 9.11.5-P4\n\u003e=    BIND 9.12.3-P4\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n\u003e=    BIND 9.11.5-S5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Zone transfer controls for writable DLZ zones were not effective",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-officer@isc.org",
          "DATE_PUBLIC": "2019-02-21T00:00:00.000Z",
          "ID": "CVE-2019-6465",
          "STATE": "PUBLIC",
          "TITLE": "Zone transfer controls for writable DLZ zones were not effective"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIND 9",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "BIND 9",
                            "version_value": "BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P2, 9.12.0 -\u003e 9.12.3-P2, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ISC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P2, 9.12.0 -\u003e 9.12.3-P2, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A client exercising this defect can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.isc.org/docs/cve-2019-6465",
              "refsource": "CONFIRM",
              "url": "https://kb.isc.org/docs/cve-2019-6465"
            },
            {
              "name": "RHSA-2019:3552",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3552"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to the patched release most closely related to your current version of BIND:\n\n\u003e=    BIND 9.11.5-P4\n\u003e=    BIND 9.12.3-P4\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n\u003e=    BIND 9.11.5-S5"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2019-6465",
    "datePublished": "2019-10-09T14:17:14.410560Z",
    "dateReserved": "2019-01-16T00:00:00",
    "dateUpdated": "2024-09-16T20:37:52.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-5745 (GCVE-0-2018-5745)

Vulnerability from cvelistv5 – Published: 2019-10-09 14:17 – Updated: 2024-09-16 23:51

Summary

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

Severity ?

4.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE

This particular vulnerability would be very difficult for an arbitrary attacker to use because it requires an operator to have BIND configured to use a trust anchor managed by the attacker. However, if successfully exercised, the defect will cause named to deliberately exit after encountering an assertion failure. It is more likely, perhaps, that this bug could be encountered accidentally, as not all versions of BIND support the same set of cryptographic algorithms. Specifically, recent branches of BIND have begun deliberately removing support for cryptographic algorithms that are now deprecated (for example because they are no longer considered sufficiently secure.) This vulnerability could be encountered if a resolver running a version of BIND which has removed support for deprecated algorithms is configured to use a trust anchor which elects to change algorithm types to one of those deprecated algorithms. Support for GOST was removed from BIND in 9.13.1. Support for DSA was removed from BIND in 9.13.4 Support for RSAMD5 will be removed from future BIND releases in the 9.13 branch and higher.

Assigner

isc

References

URL

Tags

	https://kb.isc.org/docs/cve-2018-5745	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2019:3552	vendor-advisoryx_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	ISC	BIND 9	Affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T05:40:51.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.isc.org/docs/cve-2018-5745"
          },
          {
            "name": "RHSA-2019:3552",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3552"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIND 9",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745."
            }
          ]
        }
      ],
      "datePublic": "2019-02-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "\"managed-keys\" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor\u0027s keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "This particular vulnerability would be very difficult for an arbitrary attacker to use because it requires an operator to have BIND configured to use a trust anchor managed by the attacker. However, if successfully exercised, the defect will cause named to deliberately exit after encountering an assertion failure.\n\nIt is more likely, perhaps, that this bug could be encountered accidentally, as not all versions of BIND support the same set of cryptographic algorithms. Specifically, recent branches of BIND have begun deliberately removing support for cryptographic algorithms that are now deprecated (for example because they are no longer considered sufficiently secure.) This vulnerability could be encountered if a resolver running a version of BIND which has removed support for deprecated algorithms is configured to use a trust anchor which elects to change algorithm types to one of those deprecated algorithms.\n\n    Support for GOST was removed from BIND in 9.13.1.\n    Support for DSA was removed from BIND in 9.13.4\n    Support for RSAMD5 will be removed from future BIND releases in the 9.13 branch and higher.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-06T00:07:02",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.isc.org/docs/cve-2018-5745"
        },
        {
          "name": "RHSA-2019:3552",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3552"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to a version of BIND containing a fix preventing the assertion failure.\n\n\u003e=    BIND 9.11.5-P4\n\u003e=    BIND 9.12.3-P4\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n\u003e=    BIND 9.11.5-S5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-officer@isc.org",
          "DATE_PUBLIC": "2019-02-21T00:00:00.000Z",
          "ID": "CVE-2018-5745",
          "STATE": "PUBLIC",
          "TITLE": "An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIND 9",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "BIND 9",
                            "version_value": "BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ISC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "\"managed-keys\" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor\u0027s keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -\u003e 9.10.8-P1, 9.11.0 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.9.3-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "This particular vulnerability would be very difficult for an arbitrary attacker to use because it requires an operator to have BIND configured to use a trust anchor managed by the attacker. However, if successfully exercised, the defect will cause named to deliberately exit after encountering an assertion failure.\n\nIt is more likely, perhaps, that this bug could be encountered accidentally, as not all versions of BIND support the same set of cryptographic algorithms. Specifically, recent branches of BIND have begun deliberately removing support for cryptographic algorithms that are now deprecated (for example because they are no longer considered sufficiently secure.) This vulnerability could be encountered if a resolver running a version of BIND which has removed support for deprecated algorithms is configured to use a trust anchor which elects to change algorithm types to one of those deprecated algorithms.\n\n    Support for GOST was removed from BIND in 9.13.1.\n    Support for DSA was removed from BIND in 9.13.4\n    Support for RSAMD5 will be removed from future BIND releases in the 9.13 branch and higher."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.isc.org/docs/cve-2018-5745",
              "refsource": "CONFIRM",
              "url": "https://kb.isc.org/docs/cve-2018-5745"
            },
            {
              "name": "RHSA-2019:3552",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3552"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to a version of BIND containing a fix preventing the assertion failure.\n\n\u003e=    BIND 9.11.5-P4\n\u003e=    BIND 9.12.3-P4\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n\u003e=    BIND 9.11.5-S5"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2018-5745",
    "datePublished": "2019-10-09T14:17:14.370307Z",
    "dateReserved": "2018-01-17T00:00:00",
    "dateUpdated": "2024-09-16T23:51:32.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-5744 (GCVE-0-2018-5744)

Vulnerability from cvelistv5 – Published: 2019-10-09 14:17 – Updated: 2024-09-16 22:21

Summary

A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.

Severity ?

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

By exploiting this condition, an attacker can potentially cause named's memory use to grow without bounds until all memory available to the process is exhausted. Typically a server process is limited as to the amount of memory it can use but if the named process is not limited by the operating system all free memory on the server could be exhausted.

Assigner

isc

References

URL

Tags

https://kb.isc.org/docs/cve-2018-5744

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	ISC	BIND 9	Affected: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.

Credits

ISC would like to thank Toshifumi Sakaguchi for reporting this issue to us.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T05:40:51.153Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.isc.org/docs/cve-2018-5744"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIND 9",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "BIND 9.10.7 -\u003e 9.10.8-P1, 9.11.3 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.10.7-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected."
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ISC would like to thank Toshifumi Sakaguchi for reporting this issue to us."
        }
      ],
      "datePublic": "2019-02-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -\u003e 9.10.8-P1, 9.11.3 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.10.7-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "By exploiting this condition, an attacker can potentially cause named\u0027s memory use to grow without bounds until all memory available to the process is exhausted. Typically a server process is limited as to the amount of memory it can use but if the named process is not limited by the operating system all free memory on the server could be exhausted.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-09T14:17:14",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.isc.org/docs/cve-2018-5744"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to a version of BIND containing a fix for the memory leak.\n\n \u003e=   BIND 9.11.5-P4\n \u003e=   BIND 9.12.3-P4"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "A specially crafted packet can cause named to leak memory",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-officer@isc.org",
          "DATE_PUBLIC": "2019-02-21T00:00:00.000Z",
          "ID": "CVE-2018-5744",
          "STATE": "PUBLIC",
          "TITLE": "A specially crafted packet can cause named to leak memory"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIND 9",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "BIND 9",
                            "version_value": "BIND 9.10.7 -\u003e 9.10.8-P1, 9.11.3 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.10.7-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ISC"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "ISC would like to thank Toshifumi Sakaguchi for reporting this issue to us."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -\u003e 9.10.8-P1, 9.11.3 -\u003e 9.11.5-P1, 9.12.0 -\u003e 9.12.3-P1, and versions 9.10.7-S1 -\u003e 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -\u003e 9.13.6 of the 9.13 development branch are also affected."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "By exploiting this condition, an attacker can potentially cause named\u0027s memory use to grow without bounds until all memory available to the process is exhausted. Typically a server process is limited as to the amount of memory it can use but if the named process is not limited by the operating system all free memory on the server could be exhausted."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.isc.org/docs/cve-2018-5744",
              "refsource": "CONFIRM",
              "url": "https://kb.isc.org/docs/cve-2018-5744"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to a version of BIND containing a fix for the memory leak.\n\n \u003e=   BIND 9.11.5-P4\n \u003e=   BIND 9.12.3-P4"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2018-5744",
    "datePublished": "2019-10-09T14:17:14.332021Z",
    "dateReserved": "2018-01-17T00:00:00",
    "dateUpdated": "2024-09-16T22:21:17.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-1194

CVE-2019-6465 (GCVE-0-2019-6465)

CVE-2018-5745 (GCVE-0-2018-5745)

CVE-2018-5744 (GCVE-0-2018-5744)

Tags

Sightings

Nomenclature