vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-5740

A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

HIGH
7.5
CVSS Score
Published: January 16, 2019 at 08:00 PM UTC
Updated: June 17, 2026 at 02:00 AM UTC
11 products affected across 7 vendorsDebian LinuxUbuntu LinuxEnterprise Linux Desktop

Using BIND 9 by ISC?

Get instant alerts when new vulnerabilities affect BIND 9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 60%

Description

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux· Canonicalrubygems
95%
12.0414.0416.0418.04
Debian Linux· Debiandrupal
95%
8.09.0
HP Ux· HP
95%
All versions
BIND· Isc
95%
9.10.0 ≤ v < 9.10.89.11.0 ≤ v < 9.11.49.12.0 ≤ v < 9.12.29.13.0 ≤ v < 9.13.29.7.0 ≤ v < 9.8.89.9.0 ≤ v < 9.9.13BIND 9 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2
Affected range stops below 9.10.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.11.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.12.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.13.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.8.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.9.13, so it looks safe — our inference, not a vendor statement
Data Ontap Edge· NetApp
95%
All versions
Leap· openSUSEdrupal
95%
15.015.142.3
Enterprise Linux Desktop· Red Hatrubygems
95%
6.07.0
Enterprise Linux Server· Red Hatrubygems
95%
6.07.0
Enterprise Linux Server Aus· Red Hatrubygems
95%
7.6
Enterprise Linux Server Eus· Red Hatrubygems
95%
7.57.6

References (14)

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00026.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00027.html
VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/105055
VDB Entryx_refsource_SECTRACKThird Party Advisory
Source: [email protected]
http://www.securitytracker.com/id/1041436
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:2570
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:2571
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://kb.isc.org/docs/aa-01639
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2018/08/msg00033.html

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-617

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card