Vulnerabilities

TI-2018-04148 CVE-2018-5741 · GHSA-ghpp-72v8-mpmv

Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

LOW 35

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03451 Published 2019-01-16 Partial fix CWE-863

TI-2018-04147 CVE-2018-5740 · GHSA-rqpc-6vjv-w22p

A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

HIGH 67

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.60236 Published 2019-01-16 Partial fix CWE-617

TI-2018-04145 CVE-2018-5738 · GHSA-cg2m-4gq8-j388

Some versions of BIND can improperly permit recursive query service to unauthorized clients

MEDIUM 46

Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1137 Published 2019-01-16 No fix listed CWE-200

Vulnerabilities

Filters

Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

Some versions of BIND can improperly permit recursive query service to unauthorized clients