BIND Package Vulnerability: Assertion Failure Due to Zone Database Reference Counting
Summary
ALPINE-CVE-2018-5736: An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. Affects bind versions < 9.12.1_p2-r0. Fixed in 9.12.1_p2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS (Domain Name System) software suite that provides a variety of DNS services, including authoritative DNS and DNS resolver functionalities. It is known for its robustness and flexibility, making it a popular choice for managing DNS records. However, certain versions of BIND are vulnerable to a specific issue that can lead to server crashes under certain conditions, particularly during zone transfers.
Vulnerability Detail
The vulnerability, identified as CVE-2018-5736, arises from an error in zone database reference counting. This flaw can lead to an assertion failure when a server running an affected version of BIND attempts multiple transfers of a slave zone in rapid succession. An attacker with permission to initiate zone transfers could exploit this defect by sending valid NOTIFY messages, causing the named process to terminate unexpectedly after failing an assertion test. The affected versions include BIND 9.12.0 and 9.12.1, with a CVSS score of 5.3 indicating a moderate severity level.
How To Fix
Minimum fixed version
9.12.1_p2-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the DNS server to trusted sources only. This can be done by configuring firewall rules to limit incoming connections to known IP addresses that are allowed to initiate zone transfers.
Conclusion
In summary, CVE-2018-5736 is a significant vulnerability in the BIND package that can lead to server crashes during zone transfers. It is crucial to update to the patched version 9.12.1_p2-r0 to mitigate this risk. Implementing workarounds can provide temporary relief while a full update is planned.
See every vulnerability recorded for bind →
FAQ
CVE-2018-5736 is a vulnerability in the BIND DNS software that can cause assertion failures and server crashes during zone transfers.
The affected versions include BIND 9.12.0 and 9.12.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update the package immediately, consider implementing firewall rules to restrict access to the DNS server to only trusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
