CVE-2018-5740 : What You Need to Know

A flaw in the "deny-answer-aliases" feature in BIND 9 can lead to an assertion failure, potentially causing denial of service to clients.

Understanding CVE-2018-5740

This CVE involves a vulnerability in BIND 9 that affects specific versions and can result in a denial of service.

What is CVE-2018-5740?

The "deny-answer-aliases" feature in BIND 9, designed to protect against DNS rebinding attacks, contains a flaw that can trigger an assertion failure, impacting server operation.

The Impact of CVE-2018-5740

The vulnerability can lead to a denial of service for clients accessing servers with the affected feature enabled.

Technical Details of CVE-2018-5740

This section delves into the technical aspects of the CVE.

Vulnerability Description

The flaw in the "deny-answer-aliases" feature can cause an assertion failure in named, halting the process and disrupting service.

Affected Systems and Versions

Versions 9.7.0 to 9.8.8, 9.9.0 to 9.9.13, 9.10.0 to 9.10.8, 9.11.0 to 9.11.4, 9.12.0 to 9.12.2, and 9.13.0 to 9.13.2 of BIND are impacted.

Exploitation Mechanism

Enabling the "deny-answer-aliases" feature can trigger the vulnerability, leading to the assertion failure.

Mitigation and Prevention

Steps to address and prevent the CVE.

Immediate Steps to Take

Disable the "deny-answer-aliases" feature if not essential

Long-Term Security Practices

Regularly update BIND to patched versions
Follow security advisories from ISC and other relevant sources

Patching and Updates

Upgrade to the patched release closest to your current BIND version, such as 9.9.13-P1, 9.10.8-P1, 9.11.4-P1, or 9.12.2-P1.