Skip to content
OpenAdvisories
High ALAS2-2018-1082 1 CVE

Important: bind security update (Amazon Linux 2)

Published Sep 20, 2018 · Updated Sep 25, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5740: A denial of service flaw was discovered in bind versions that include the "deny-answer-aliases" feature. This flaw may allow a remote attacker to trigger an INSIST assert in named leading to termination of the process and a denial of service condition. 1613595: CVE-2018-5740 bind: processing of certain records when "deny-answer-aliases" is in use may trigger an assert leading to a denial of service

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-chroot 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-debuginfo 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-devel 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-libs 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-libs-lite 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-lite-devel 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-pkcs11 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-pkcs11-devel 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-pkcs11-libs 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-pkcs11-utils 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-sdb 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-sdb-chroot 32:9.9.4-61.amzn2.1.1
Amazon Linux · 2 bind-utils 32:9.9.4-61.amzn2.1.1

Vulnerabilities 1

  • High 7.5
    CVE-2018-5740 Public exploit EPSS 60%

    A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

    "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-5740.html