Assertion failure in bind (Alpine package)

1) Assertion failure

EUVDB-ID: #VU14291

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-5740

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows an attacker to perform denial of service (DoS) attack.

The vulnerability exists due to INSIST assertion failure in name.c when processing recursive queries. A remote attacker can trigger denial of service conditions if the affected server is configured with enabled "deny-answer-aliases" feature.

Mitigation

Install update from vendor's website.

Vulnerable software versions

bind (Alpine package): 9.7.1-r0 - 9.10.8-r0

CPE2.3

• cpe:2.3:o:alpine:bind_alpine_package:9.7.1-r0:*:*:*:*:alpine_linux:*:2.0
• cpe:2.3:o:alpine:bind_alpine_package:9.7.3-r0:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:o:alpine:bind_alpine_package:9.7.4_p1-r0:*:*:*:*:alpine_linux:*:2.1

External links

https://git.alpinelinux.org/aports/commit/?id=6a7a5020482526d5f8f38aa59bf9da6e245d2264
https://git.alpinelinux.org/aports/commit/?id=a72d66cd67f20dec8e4eb3d6f2b387a11a0bfbf8
https://git.alpinelinux.org/aports/commit/?id=38babe0be83e60e85a304ad8ab72000df9736a30
https://git.alpinelinux.org/aports/commit/?id=37ad006279f2ad8d29a3de1622a8d8e08e0d9814
https://git.alpinelinux.org/aports/commit/?id=a72a5291c3473990e2ec0256973c8ea1b78a2f77
https://git.alpinelinux.org/aports/commit/?id=4ec71c5ae6c53d4cf8c9a8f89a4ea19656a56b71
https://git.alpinelinux.org/aports/commit/?id=5b89784c2f0f07bfbb31371b85fd9c1be3acada5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.