CVE-2018-5738 : Security Advisory and Response
Learn about CVE-2018-5738, a vulnerability in certain BIND versions allowing unauthorized clients to perform recursive queries. Find mitigation steps and future updates.
A vulnerability in certain versions of BIND can lead to unauthorized clients being able to make recursive queries to a BIND nameserver, potentially causing security risks.
Understanding CVE-2018-5738
This CVE involves a regression issue introduced by Change #4777 in BIND versions, affecting the handling of recursive queries by unauthorized clients.
What is CVE-2018-5738?
The vulnerability allows unauthorized clients to perform recursive queries on a BIND nameserver due to an unexpected issue introduced by a specific change in October 2017.
The Impact of CVE-2018-5738
The vulnerability can lead to unauthorized clients making queries to the server, potentially causing increased server load, enabling DNS reflection attacks, and leaking private information.
Technical Details of CVE-2018-5738
The technical aspects of the vulnerability include:
Vulnerability Description
The issue arises from a regression introduced by Change #4777, affecting the default behavior of the "allow-recursion" setting in BIND versions.
Affected Systems and Versions
- Affected versions include BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0 to 9.12.1-P2, and 9.13.0, as well as specific releases from BIND 9 Supported Preview Edition.
Exploitation Mechanism
- No known exploits target this specific vulnerability, but unauthorized clients can potentially exploit it for malicious activities.
Mitigation and Prevention
Steps to address and prevent the vulnerability:
Immediate Steps to Take
- Implement configuration workarounds to avoid the issue, such as explicitly setting "allow-query {localnets; localhost;};" in named.conf.
Long-Term Security Practices
- Configure match list values for "allow-recursion", "allow-query", or "allow-query-cache" to prevent improper inheritance of settings.
- Servers not intended for recursion can set "recursion no;" in named.conf.
Patching and Updates
- Future maintenance releases of BIND will address the regression, with correction debuting in release candidates for specific versions.