PT-2019-4631 · Isc+3 · Bind 9+3

Published 2019-02-21 · Updated 2019-11-05 · CVE-2018-5744

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.10.7 through 9.10.8-P1 BIND 9 versions 9.11.3 through 9.11.5-P1 BIND 9 versions 9.12.0 through 9.12.3-P1 BIND 9 Supported Preview Edition versions 9.10.7-S1 through 9.11.5-S3 BIND 9 versions 9.13.0 through 9.13.6

Description The issue is related to incorrect processing of messages with a specific combination of EDNS options, which can lead to a failure to free memory. This can cause a denial of service due to memory exhaustion. The vulnerability can be exploited by a remote attacker.

Recommendations For BIND 9 versions 9.10.7 through 9.10.8-P1, update to a version outside of this range to resolve the issue. For BIND 9 versions 9.11.3 through 9.11.5-P1, update to a version outside of this range to resolve the issue. For BIND 9 versions 9.12.0 through 9.12.3-P1, update to a version outside of this range to resolve the issue. For BIND 9 Supported Preview Edition versions 9.10.7-S1 through 9.11.5-S3, update to a version outside of this range to resolve the issue. For BIND 9 versions 9.13.0 through 9.13.6, update to a version outside of this range to resolve the issue.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

ALT-PU-2019-1290

BDU:2020-00777

CVE-2018-5744

USN-3893-1

Affected Products

Alt Linux

Bind 9

Bind Server

Ubuntu

References · 23

• https://ubuntu.com/security/CVE-2018-5744 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5744 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3893-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-5744 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00777 · Security Note
• https://bdu.fstec.ru/vul/2020-00773 · Security Note
• https://kb.isc.org/docs/cve-2018-5744 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6465 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5744 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5744 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5745 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-5744 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1290 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5744 · Vendor Advisory