Skip to content
OpenAdvisories
High ALAS2-2019-1231 1 CVE

Important: bind security update (Amazon Linux 2)

Published Jun 25, 2019 · Updated Jul 1, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5743: A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files. In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system. 1702541: CVE-2018-5743 bind: Limiting simultaneous TCP clients is ineffective

Fixed packages 15

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-chroot 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-debuginfo 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-devel 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-libs 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-libs-lite 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-license 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-lite-devel 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-pkcs11 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-pkcs11-devel 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-pkcs11-libs 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-pkcs11-utils 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-sdb 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-sdb-chroot 32:9.9.4-74.amzn2.1.2
Amazon Linux · 2 bind-utils 32:9.9.4-74.amzn2.1.2

Vulnerabilities 1

  • High 7.5
    CVE-2018-5743

    Limiting simultaneous TCP clients was ineffective

    By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-5743.html