Assertion failure in bind (Alpine package)
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-5740 |
| CWE-ID | CWE-617 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
bind (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Assertion failure
EUVDB-ID: #VU14291
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-5740
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows an attacker to perform denial of service (DoS) attack.
The vulnerability exists due to INSIST assertion failure in name.c when processing recursive queries. A remote attacker can trigger denial of service conditions if the affected server is configured with enabled "deny-answer-aliases" feature.
MitigationInstall update from vendor's website.
Vulnerable software versionsbind (Alpine package): 9.7.1-r0 - 9.10.8-r0
External linkshttp://git.alpinelinux.org/aports/commit/?id=6a7a5020482526d5f8f38aa59bf9da6e245d2264
http://git.alpinelinux.org/aports/commit/?id=a72d66cd67f20dec8e4eb3d6f2b387a11a0bfbf8
http://git.alpinelinux.org/aports/commit/?id=38babe0be83e60e85a304ad8ab72000df9736a30
http://git.alpinelinux.org/aports/commit/?id=37ad006279f2ad8d29a3de1622a8d8e08e0d9814
http://git.alpinelinux.org/aports/commit/?id=a72a5291c3473990e2ec0256973c8ea1b78a2f77
http://git.alpinelinux.org/aports/commit/?id=4ec71c5ae6c53d4cf8c9a8f89a4ea19656a56b71
http://git.alpinelinux.org/aports/commit/?id=5b89784c2f0f07bfbb31371b85fd9c1be3acada5
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
