{"id":"CVE-2018-5740","published":"2019-01-16T20:00:00Z","modified":"2024-09-16T17:58:43Z","title":"A flaw in the \"deny-answer-aliases\" feature can cause an assertion failure in named","vendor":"ISC","product":"BIND 9","tier":"core","eol":null,"affectedVersions":[{"vendor":"ISC","product":"BIND 9","versions":["BIND 9  9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2"]}],"description":{"text":"\"deny-answer-aliases\" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the \"deny-answer-aliases\" feature of ISC BIND 9 causes an assertion failure in name.c when the feature is enabled. An attacker with network access and no authentication or user interaction can trigger the assertion failure, which crashes the named server; the feature must be in use for the flaw to be reachable.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:18Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.60236,"percentile":0.99134,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/105055","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00033.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2570","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2571","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://usn.ubuntu.com/3769-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securitytracker.com/id/1041436","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://security.netapp.com/advisory/ntap-20180926-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://kb.isc.org/docs/aa-01639","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/3769-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://security.gentoo.org/glsa/201903-13","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-17509","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-17509","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2018-08-15","earliestUrl":"https://github.com/sischkg/cve-2018-5740","repos":[{"name":"sischkg/cve-2018-5740","url":"https://github.com/sischkg/cve-2018-5740","stars":3,"created":"2018-08-15"}]},"first":{"date":"2018-08-15","source":"PoC-in-GitHub","url":"https://github.com/sischkg/cve-2018-5740"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2018-08-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sischkg/cve-2018-5740","provenance":"source"},{"date":"2019-01-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-5740","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9913"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}