What’s Vulnerable › Vulnerabilities

CVE-2018-5740: A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 59.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-16 · updated 2026-06-17
• Weakness: CWE-617

Description

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04
• Debian Linux: 8.0, 9.0
• Hewlett Packard Enterprise (HPE) HP-UX: all versions
• ISC BIND: from 9.7.0 before 9.8.8; from 9.9.0 before 9.9.13; from 9.10.0 before 9.10.8; from 9.11.0 before 9.11.4; from 9.12.0 before 9.12.2; from 9.13.0 before 9.13.2 — fixed in 9.10.8, 9.11.4, 9.12.2, 9.13.2, 9.8.8, 9.9.13
• NetApp Data Ontap Edge: all versions
• openSUSE Leap: 15.0, 15.1, 42.3
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.6
• RedHat Enterprise Linux Server Eus: 7.5, 7.6
• RedHat Enterprise Linux Workstation: 6.0, 7.0

How to fix

Upgrade to a fixed version: ISC BIND 9.10.8, 9.11.4, 9.12.2, 9.13.2. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00027.html
• http://www.securityfocus.com/bid/105055
• http://www.securitytracker.com/id/1041436
• https://access.redhat.com/errata/RHSA-2018:2570
• https://access.redhat.com/errata/RHSA-2018:2571
• https://kb.isc.org/docs/aa-01639
• https://lists.debian.org/debian-lts-announce/2018/08/msg00033.html
• https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
• https://security.gentoo.org/glsa/201903-13
• https://security.netapp.com/advisory/ntap-20180926-0003/
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us

Get alerted when CVE-2018-5740 or the next vulnerability affects your stack