CVE-2018-5740
High"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers.
Published Jan 16, 2019 · Updated Aug 7, 2026 · Also known as ALPINE-CVE-2018-5740, DEBIAN-CVE-2018-5740, DLA-1485-1, DLA-2807-1, SUSE-SU-2019:1407-1, SUSE-SU-2019:14074-1, SUSE-SU-2019:1449-1, SUSE-SU-2019:2502-1, UBUNTU-CVE-2018-5740, USN-3769-1
Key Facts
Patch immediately- CVE-2018-5740 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Bind (Isc), Data Ontap Edge (Netapp), Ubuntu Linux (Canonical) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 60% probability of exploitation in the next 30 days.
- Fixed versions are available, including Bind 32:9.8.2-0.68.rc1.58.amzn1, Bind 32:9.8.2-0.68.rc1.el6_10.1, Bind 32:9.9.4-61.amzn2.1.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
60%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-5740 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.
Affected Products
251 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| BindIsc | See advisory | 9.8.8 |
| Data Ontap EdgeNetapp | See advisory | n/a |
| Ubuntu LinuxCanonical | 12.04, 14.04, 16.04, 18.04 | n/a |
| Debian LinuxDebian | 8.0, 9.0 | n/a |
| Hp-UxHp | See advisory | n/a |
Patched Releases
Bind
32:9.8.2-0.68.rc1.58.amzn1, 32:9.8.2-0.68.rc1.el6_10.1, 32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1, 9.10.8_p1-r0, 9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1, 9.11.4_p1-r0, 9.12.2_p1-r0, 9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1, 9.8.8
bind-chroot
32:9.8.2-0.68.rc1.58.amzn1, 32:9.8.2-0.68.rc1.el6_10.1, 32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-chrootenv
9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1, 9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1
bind-devel
32:9.8.2-0.68.rc1.58.amzn1, 32:9.8.2-0.68.rc1.el6_10.1, 32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1, 9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1, 9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1
bind-devel-32bit
9.11.2-lp151.11.3.1
bind-doc
9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1, 9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1
bind-libs
32:9.8.2-0.68.rc1.58.amzn1, 32:9.8.2-0.68.rc1.el6_10.1, 32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1, 9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1
bind-libs-32bit
9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1
bind-libs-lite
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-license
32:9.9.4-61.el7_5.1
bind-lite-devel
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-lwresd
9.11.2-lp151.11.3.1, 9.9.9P1-56.1
bind-pkcs11
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-pkcs11-devel
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-pkcs11-libs
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-pkcs11-utils
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-sdb
32:9.8.2-0.68.rc1.58.amzn1, 32:9.8.2-0.68.rc1.el6_10.1, 32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-sdb-chroot
32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1
bind-utils
32:9.8.2-0.68.rc1.58.amzn1, 32:9.8.2-0.68.rc1.el6_10.1, 32:9.9.4-61.amzn2.1.1, 32:9.9.4-61.el7_5.1, 9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1, 9.9.6P1-0.51.15.4, 9.9.9P1-28.42.1, 9.9.9P1-56.1
bind9
1:9.10.3.dfsg.P4-12.3+deb9u10, 1:9.10.3.dfsg.P4-8ubuntu1.11, 1:9.11.3+dfsg-1ubuntu1.2, 1:9.11.4.P1+dfsg-1, 1:9.9.5.dfsg-3ubuntu0.18, 1:9.9.5.dfsg-9+deb8u16
bindutils
NA
libbind9-160
9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1
libbind9-160-32bit
9.11.2-lp151.11.3.1
libdns169
9.11.2-12.11.2, 9.11.2-3.10.1, 9.11.2-lp151.11.3.1
libdns169-32bit
9.11.2-lp151.11.3.1
Timeline
Publicly disclosed
Jan 16, 2019
Last updated
Aug 7, 2026
Weakness Type
- CWE-617 Reachable Assertion
References
- advisoryopenSUSE-SU-2019:1532
- advisoryopenSUSE-SU-2019:1533
- advisoryRHSA-2018:2570
- advisoryRHSA-2018:2571
- advisoryhttps://bugzilla.suse.com/1104129
FAQ
Common Questions.
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers.
Affected: Bind (Isc); Data Ontap Edge (Netapp); Ubuntu Linux (Canonical) versions 12.04, 14.04, 16.04, 18.04, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Bind 32:9.8.2-0.68.rc1.58.amzn1, Bind 32:9.8.2-0.68.rc1.el6_10.1, Bind 32:9.9.4-61.amzn2.1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-5740 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo