CVE-2018-5743

2019-04-2400:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.4%

JSON

By design, BIND is intended to limit the number of TCP clients that can be
connected at any given time. The number of allowed connections is a tunable
parameter which, if unset, defaults to a conservative value for most
servers. Unfortunately, the code which was intended to limit the number of
simultaneous connections contained an error which could be exploited to
grow the number of simultaneous connections beyond this limit. Versions
affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4,
9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3,
and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are
also affected. Versions prior to BIND 9.9.0 have not been evaluated for
vulnerability to CVE-2018-5743.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchbind9< 1:9.11.3+dfsg-1ubuntu1.7UNKNOWN
ubuntu18.10noarchbind9< 1:9.11.4+dfsg-3ubuntu5.3UNKNOWN
ubuntu19.04noarchbind9< 1:9.11.5.P1+dfsg-1ubuntu2.3UNKNOWN
ubuntu14.04noarchbind9< 1:9.9.5.dfsg-3ubuntu0.19+esm1UNKNOWN
ubuntu16.04noarchbind9< 1:9.10.3.dfsg.P4-8ubuntu1.14UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	bind9	< 1:9.11.3+dfsg-1ubuntu1.7	UNKNOWN
ubuntu	18.10	noarch	bind9	< 1:9.11.4+dfsg-3ubuntu5.3	UNKNOWN
ubuntu	19.04	noarch	bind9	< 1:9.11.5.P1+dfsg-1ubuntu2.3	UNKNOWN
ubuntu	14.04	noarch	bind9	< 1:9.9.5.dfsg-3ubuntu0.19+esm1	UNKNOWN
ubuntu	16.04	noarch	bind9	< 1:9.10.3.dfsg.P4-8ubuntu1.14	UNKNOWN