CVE-2018-5734 : Exploit Details and Defense Strategies

A vulnerability in BIND versions 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, and 9.10.6-S2 could lead to an assertion failure in badcache.c due to mishandling of specific malformed packets.

Understanding CVE-2018-5734

This CVE describes a scenario where BIND may incorrectly use a SERVFAIL rcode instead of a FORMERR rcode, potentially causing an assertion failure under certain conditions.

What is CVE-2018-5734?

BIND, a widely used DNS software, could encounter an assertion failure in badcache.c if a malformed packet triggers the selection of a SERVFAIL rcode instead of a FORMERR rcode. This issue impacts versions 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, and 9.10.6-S2.

The Impact of CVE-2018-5734

The vulnerability poses a high availability impact, with a CVSS base score of 7.5 (High severity). It does not affect confidentiality or integrity but can lead to service unavailability.

Technical Details of CVE-2018-5734

This section delves into the specifics of the vulnerability.

Vulnerability Description

BIND may mistakenly choose a SERVFAIL rcode over a FORMERR rcode when processing malformed packets, potentially triggering an assertion failure in badcache.c.

Affected Systems and Versions

Affected Versions: 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, 9.10.6-S2

Exploitation Mechanism

The vulnerability can be exploited by sending a specific type of malformed packet to a vulnerable BIND server, causing it to select the incorrect rcode and potentially leading to an assertion failure.

Mitigation and Prevention

Protecting systems from CVE-2018-5734 involves taking immediate steps and implementing long-term security practices.

Immediate Steps to Take

Upgrade to BIND 9 version 9.10.6-S3, the patched release that addresses this vulnerability.
Disable the SERVFAIL cache with 'servfail-ttl 0;' to prevent the assertion failure.

Long-Term Security Practices

Regularly update BIND to the latest versions to ensure protection against known vulnerabilities.

Patching and Updates

Ensure that all BIND installations are updated to version 9.10.6-S3 to mitigate the risk of exploitation.