While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has bind packages installed that are affected by a vulnerability:

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate will     be provided. (CVE-2018-5742)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Crash from assertion error when debug log level is 10 and log entries meet buffer boundary. This flaw appears to be exploitable only when debug logging is enabled and set to at least a level of 10. As this configuration should be rare in production instances of bind, it is unlikely that most servers will be exploitable. The debug level of the bind server can be checked via the rndc status command, which will return the current trace level as 'debug level'. A value of 10 or above would most likely make this flaw exploitable.(CVE-2018-5742)

An update for bind is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es) :

* bind: Crash from assertion error when debug log level is 10 and log entries meet buffer boundary (CVE-2018-5742)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0194 advisory.

    [32:9.9.4-73]
    - Fixes debug level comments (#1647539)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - bind: Crash from assertion error when debug log level is     10 and log entries meet buffer boundary (CVE-2018-5742)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0194 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: Crash from assertion error when debug log level is 10 and log entries meet buffer boundary     (CVE-2018-5742)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
127258	NewStart CGSL CORE 5.04 / MAIN 5.04 : bind Vulnerability (NS-SA-2019-0063)	Nessus	NewStart CGSL Local Security Checks	high
122676	Amazon Linux 2 : bind (ALAS-2019-1170)	Nessus	Amazon Linux Local Security Checks	high
121548	CentOS 7 : bind (CESA-2019:0194)	Nessus	CentOS Local Security Checks	high
121497	Oracle Linux 7 : bind (ELSA-2019-0194)	Nessus	Oracle Linux Local Security Checks	high
121455	Scientific Linux Security Update : bind on SL7.x x86_64 (20190129)	Nessus	Scientific Linux Local Security Checks	high
121451	RHEL 7 : bind (RHSA-2019:0194)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-5742

high

Tenable Plugins

high

high

high

high

high

high