Vulnerabilities > CVE-2018-5736 - Reachable Assertion vulnerability in multiple products

047910
CVSS 3.5 - LOW
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
isc
netapp
CWE-617
nessus

Summary

An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after failing the assertion test. Affects BIND 9.12.0 and 9.12.1.

Vulnerable Configurations

Part Description Count
Application
Isc
2
Application
Netapp
2

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_DOCKER_CVE-2019-5736.NASL
    descriptionAn update for runc is now available for CentOS 7 Extras. The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)
    last seen2020-06-01
    modified2020-06-02
    plugin id130262
    published2019-10-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130262
    titleCentos 7 : runc
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130262);
      script_version("1.1");
      script_cvs_date("Date: 2019/10/25 11:11:33");
    
      script_cve_id("CVE-2019-5736");
    
      script_name(english:"Centos 7 : runc");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." );
      script_set_attribute(attribute:"description", value:
    "An update for runc is now available for CentOS 7 Extras.
    
    The runC tool is a lightweight, portable implementation of the Open
    Container Format (OCF) that provides container runtime.
    
    A flaw was found in the way runc handled system file descriptors
    when running containers. A malicious container could use this flaw to
    overwrite contents of the runc binary and consequently run arbitrary
    commands on the container host system. (CVE-2019-5736)
    ");
      script_set_attribute(attribute:"see_also", value:"https://cbs.centos.org/koji/buildinfo?buildID=25136");
      script_set_attribute(attribute:"see_also", value:"https://cbs.centos.org/koji/buildinfo?buildID=25171");
      # https://www.docker.com/blog/docker-security-update-cve-2018-5736-and-container-security-best-practices/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?122b4713");
      script_set_attribute(attribute:"solution", value:"Update the affected runc, docker, and / or docker-ce packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-5736");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:runc");
      
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/02/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"docker-ce-18.09.2-3.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"docker-1.13.1-92.gitb2f74b2.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"runc-1.0.0-60.dev.git2abd837.el7")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "runc / docker-ce");
    }
    
  • NASL familyDNS
    NASL idBIND9_9121_P2.NASL
    descriptionThe version of ISC BIND running on the remote name server is 9.12.x prior to 9.12.1-P2. It is, therefore, affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id109947
    published2018-05-22
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109947
    titleISC BIND 9.12.x < 9.12.1-P1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109947);
      script_version("1.6");
      script_cvs_date("Date: 2019/11/04");
    
      script_cve_id("CVE-2018-5736", "CVE-2018-5737");
    
      script_name(english:"ISC BIND 9.12.x < 9.12.1-P1 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of BIND.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote name server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of ISC BIND running on the remote name server is 9.12.x 
    prior to 9.12.1-P2. It is, therefore, affected by multiple 
    vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/docs/aa-01602");
      script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/docs/aa-01606");
      # https://www.us-cert.gov/ncas/current-activity/2018/05/18/ISC-Releases-Security-Advisories-BIND
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b1939e95");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to ISC BIND version 9.12.1-P2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-5737");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/22");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:isc:bind");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"DNS");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("bind_version.nasl");
      script_require_keys("bind/version");
    
      exit(0);
    }
    
    include("vcf.inc");
    include("vcf_extras.inc");
    
    vcf::bind::initialize();
    
    app_info = vcf::get_app_info(app:"BIND", port:53, kb_ver:"bind/version", service:TRUE, proto:"UDP");
    
    constraints = [
      { "min_version" : "9.12.0", "fixed_version" : "9.12.1-P2" },
    ];
    constraints = vcf::bind::filter_constraints(constraints:constraints, version:app_info.version);
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_94599FE05CA311E88BE1D05099C0AE8C.NASL
    descriptionISC reports : An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging.
    last seen2020-06-01
    modified2020-06-02
    plugin id109929
    published2018-05-21
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109929
    titleFreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2019 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109929);
      script_version("1.6");
      script_cvs_date("Date: 2019/02/14 10:37:32");
    
      script_cve_id("CVE-2018-5736", "CVE-2018-5737");
    
      script_name(english:"FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "ISC reports :
    
    An error in zone database reference counting can lead to an assertion
    failure if a server which is running an affected version of BIND
    attempts several transfers of a slave zone in quick succession.
    
    A problem with the implementation of the new serve-stale feature in
    BIND 9.12 can lead to an assertion failure in rbtdb.c, even when
    stale-answer-enable is off. Additionally, problematic interaction
    between the serve-stale feature and NSEC aggressive negative caching
    can in some cases cause undesirable behavior from named, such as a
    recursion loop or excessive logging."
      );
      # https://kb.isc.org/article/AA-01602
      script_set_attribute(
        attribute:"see_also",
        value:"https://kb.isc.org/docs/aa-01602"
      );
      # https://kb.isc.org/article/AA-01606
      script_set_attribute(
        attribute:"see_also",
        value:"https://kb.isc.org/docs/aa-01606"
      );
      # https://vuxml.freebsd.org/freebsd/94599fe0-5ca3-11e8-8be1-d05099c0ae8c.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?0fd4fcdc"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:bind912");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/21");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"bind912<9.12.1P2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDNS
    NASL idBIND9_CVE-2018-5736.NASL
    descriptionAccording to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.12.0 or 9.12.1. It is, therefore, affected by an assertion failure vulnerability which exists in the zone database reference counting mechanism due to attempting several transfers of a slave zone in quick succession. An unauthenticated, remote attacker can exploit this to cause the named process to exit after failing the assertion test.
    last seen2020-06-01
    modified2020-06-02
    plugin id122238
    published2019-02-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122238
    titleISC BIND Assertion Failure Vulnerability (DoS)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(122238);
      script_version("1.2");
      script_cvs_date("Date: 2019/10/31 15:18:51");
    
      script_cve_id("CVE-2018-5736");
      script_bugtraq_id(104386);
    
      script_name(english:"ISC BIND Assertion Failure Vulnerability (DoS)");
      script_summary(english:"Checks the version of BIND.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote name server is affected by an assertion failure vulnerability.");
      script_set_attribute(attribute:"description", value:
    "According to its self-reported version, the instance of ISC BIND 9
    running on the remote name server is 9.12.0 or 9.12.1.  It is, 
    therefore, affected by an assertion failure vulnerability which 
    exists in the zone database reference counting mechanism due to 
    attempting several transfers of a slave zone in quick succession.
    
    An unauthenticated, remote attacker can exploit this to cause the
    named process to exit after failing the assertion test.");
      script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/docs/AA-01602");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to ISC BIND version 9.12.1-P1 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-5736");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/15");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:isc:bind");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"DNS");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("bind_version.nasl");
      script_require_keys("bind/version", "Settings/ParanoidReport");
    
      exit(0);
    }
    
    include("vcf.inc");
    include("vcf_extras.inc");
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID); # patch can be applied
    
    vcf::bind::initialize();
    
    app_info = vcf::get_app_info(app:"BIND", port:53, kb_ver:"bind/version", service:TRUE, proto:"UDP");
    
    constraints = [
      { "min_version" : "9.12.0", "max_version" : "9.12.1", "fixed_version" : "9.12.1-P1" }
    ];
    constraints = vcf::bind::filter_constraints(constraints:constraints, version:app_info.version);
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_NOTE);