Vulnerabilities > CVE-2018-5734 - Reachable Assertion vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
isc
netapp
CWE-617
nessus
NVD
Published: 2019-01-16
Updated: 2019-10-09

Summary

While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigger an assertion failure in badcache.c when the request doesn't contain all of the expected information. Affects BIND 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, 9.10.6-S2.

Vulnerable Configurations

Part Description Count
Application
Isc
4
Application
Netapp
2

Common Weakness Enumeration (CWE)

Nessus

NASL familyDNS
NASL idBIND9_CVE-2018-5734.NASL
descriptionAccording to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1 or 9.10.6-S2. It is, therefore, affected by an assertion failure vulnerability which exists in badcache.c due to selecting a SERVFAIL rcode instead of a FORMERR rcode. An unauthenticated attacker can exploit this to cause an assertion failure when the request doesn
last seen2020-06-01
modified2020-06-02
plugin id122237
published2019-02-15
reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/122237
titleISC BIND Assertion Failure Vulnerability
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(122237);
  script_version("1.2");
  script_cvs_date("Date: 2019/10/31 15:18:51");

  script_cve_id("CVE-2018-5734");
  script_bugtraq_id(103189);

  script_name(english:"ISC BIND Assertion Failure Vulnerability");
  script_summary(english:"Checks the version of BIND.");

  script_set_attribute(attribute:"synopsis", value:
"The remote name server is affected by an assertion failure 
vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of ISC BIND 9
running on the remote name server is 
9.10.5-S1 to 9.10.5-S4, 9.10.6-S1 or 9.10.6-S2.  It is, therefore, 
affected by an assertion failure vulnerability which exists in 
badcache.c due to selecting a SERVFAIL rcode instead of a FORMERR 
rcode.  An unauthenticated attacker can exploit this to cause an 
assertion failure when the request doesn't contain all the expected 
information.");
  script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/docs/aa-01562");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ISC BIND version 9.10.6-S3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-5734");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/02/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/15");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:isc:bind");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"DNS");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("bind_version.nasl");
  script_require_keys("bind/version", "Settings/ParanoidReport");

  exit(0);
}

include("vcf.inc");
include("vcf_extras.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID); # patch can be applied

vcf::bind::initialize();

app_info = vcf::get_app_info(app:"BIND", port:53, kb_ver:"bind/version", service:TRUE, proto:"UDP");

constraints = [
  { "min_version" : "9.10.5-S1", "max_version" : "9.10.5-S4", "fixed_version" : "9.10.6-S3" },
  { "min_version" : "9.10.6-S1", "max_version" : "9.10.6-S2", "fixed_version" : "9.10.6-S3" }
];
constraints = vcf::bind::filter_constraints(constraints:constraints, version:app_info.version);

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

References