CVE-2018-5743

high-risk
Published 2019-10-09

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.

Do I need to act?

~
5.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Isc F5

References (6)

Third Party Advisory https://kb.isc.org/docs/cve-2018-5743
https://support.f5.com/csp/article/K74009656?utm_source=f5support&amp%3Butm_medi...
https://www.synology.com/security/advisory/Synology_SA_19_20
Third Party Advisory https://kb.isc.org/docs/cve-2018-5743
https://support.f5.com/csp/article/K74009656?utm_source=f5support&amp%3Butm_medi...
https://www.synology.com/security/advisory/Synology_SA_19_20
58
/ 100
high-risk
Severity 26/34 · High
Exploitability 9/34 · Low
Exposure 23/34 · High