Information disclosure in ISC BIND - CVE-2018-5738
Published: June 13, 2018 / Updated: January 30, 2020
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to improper access controls. When configured with "recursion yes;" and match list values are not provided for "allow-query-cache" or "allow-query", the "allow-recursion" setting may permit all hosts to perform recursion. A remote attacker can bypass intended recursion access controls, make a recursive query to a BIND nameserver in certain cases and examine the results of queries answered from the cache to determine which queries a server has previously responded to.
Affected software
Gentoo Linux
Slackware Linux
Fedora
bind (Alpine package)
dnsperf
bind
bind-dyndb-ldap
How to mitigate CVE-2018-5738
Install updates from vendor's website.
The vendor has described the following workarounds in the advisory:
If an operator has not chosen to specify some other permission, explicitly specifying "allow-query {localnets; localhost;};" in named.conf will provide behavior equivalent to the intended default.
If the default setting is not appropriate (because the operator wants a different behavior) then depending on which clients are intended to be able to receive service for recursive queries, explicitly setting a match list value for any of:
will prevent the "allow-recursion" control from improperly inheriting a setting from the allow-query default. If a value is set for any of those values the behavior of allow-recursion will be set directly or inherited from one of the other values as described in the BIND Adminstrator Reference Manual section 6.2
- allow-recursion
- allow-query
- allow-query-cache
Servers which are not intended to perform recursion at all may also effectively prevent this condition by setting "recursion no;" in named.conf
bind (Alpine package) - update to 9.11.5_p4-r0
dnsperf - update to 2.1.0.0-17.fc27
bind - addressed in versions 9.11.3-6.fc27, 9.11.3-12.fc28, 9.11.4-1.fc27, 9.11.4-2.P1.fc27, 9.11.4-5.P1.fc28
bind-dyndb-ldap - update to 11.1-12.fc27