CVE-2018-5740

{"id": "CVE-2018-5740", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-01-16T20:29:01.017", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00026.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00027.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "http://www.securityfocus.com/bid/105055", "tags": ["VDB Entry", "Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "http://www.securitytracker.com/id/1041436", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security-officer@isc.org"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2570", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2571", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/aa-01639", "tags": ["Vendor Advisory"], "source": "security-officer@isc.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00033.html", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://security.gentoo.org/glsa/201903-13", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://security.netapp.com/advisory/ntap-20180926-0003/", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://usn.ubuntu.com/3769-1/", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}, {"url": "https://usn.ubuntu.com/3769-2/", "tags": ["Third Party Advisory"], "source": "security-officer@isc.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "\"deny-answer-aliases\" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2."}, {"lang": "es", "value": "\"deny-answer-aliases\" es una caracter\u00edstica poco utilizada que pretende ayudar a los operadores recursivos del servidor a proteger a los usuarios finales contra ataques de reenlace DNS, un m\u00e9todo para poder eludir el modelo de seguridad empleado por los navegadores del cliente. Sin embargo, un defecto en esta caracter\u00edstica hace que sea sencillo experimentar un fallo de aserci\u00f3n en name.c. Afecta a BIND desde la versi\u00f3n 9.7.0 hasta la versi\u00f3n 9.8.8, desde la versi\u00f3n 9.9.0 hasta la versi\u00f3n 9.9.13, desde la versi\u00f3n 9.10.0 hasta la versi\u00f3n 9.10.8, desde la versi\u00f3n 9.11.0 hasta la versi\u00f3n 9.11.4, desde la versi\u00f3n 9.12.0 hasta la versi\u00f3n 9.12.2 y desde la versi\u00f3n 9.13.0 hasta la versi\u00f3n 9.13.2."}], "lastModified": "2022-04-12T18:34:07.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCCA7B30-3344-4718-8B34-FE60CCE4487C", "versionEndExcluding": "9.8.8", "versionStartIncluding": "9.7.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F17A1AB-48E7-48B7-97CC-BD270649F856", "versionEndExcluding": "9.9.13", "versionStartIncluding": "9.9.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF340133-E86A-4A6D-9775-E66B46829700", "versionEndExcluding": "9.10.8", "versionStartIncluding": "9.10.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94AD1D77-45DD-49F2-AA16-6E3A3BF8F5C9", "versionEndExcluding": "9.11.4", "versionStartIncluding": "9.11.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5464FDED-E02B-486F-8699-CB7B9D623A59", "versionEndExcluding": "9.12.2", "versionStartIncluding": "9.12.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0484A7C1-5E99-49A6-BE21-BB201D2D0EFA", "versionEndExcluding": "9.13.2", "versionStartIncluding": "9.13.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B353CE99-D57C-465B-AAB0-73EF581127D1"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF77CDCF-B9C9-427D-B2BF-36650FB2148C"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0C4B1E5-75BF-43AE-BBAC-0DD4124C71ED"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "8D305F7A-D159-4716-AB26-5E38BB5CD991"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F480AA32-841A-4E68-9343-B2E7548B0A0C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1E78106-58E6-4D59-990F-75DA575BFAD9"}, {"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"}, {"criteria": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3"}], "operator": "OR"}]}], "sourceIdentifier": "security-officer@isc.org"}