CVE-2018-5743 Limiting simultaneous TCP clients was ineffective
HighCVSS 7.5
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bind9(Debian:12) | < 1:9.11.5.P4+dfsg-4 | 1:9.11.5.P4+dfsg-4 |
| debian/bind9(Debian:13) | < 1:9.11.5.P4+dfsg-4 | 1:9.11.5.P4+dfsg-4 |
| debian/bind9(Debian:14) | < 1:9.11.5.P4+dfsg-4 | 1:9.11.5.P4+dfsg-4 |
| f5 big-ip local traffic manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip local traffic manager | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip local traffic manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip local traffic manager | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip local traffic manager | = 15.0.0 | No fix listed |
| f5 big-ip application acceleration manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip application acceleration manager | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip application acceleration manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip application acceleration manager | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip application acceleration manager | = 15.0.0 | No fix listed |
| f5 big-ip advanced firewall manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip advanced firewall manager | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip advanced firewall manager | >= 13.1.0, <= 13.1.1 | No fix listed |
| f5 big-ip advanced firewall manager | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip advanced firewall manager | = 15.0.0 | No fix listed |
| f5 big-ip analytics | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip analytics | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip analytics | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip analytics | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip analytics | = 15.0.0 | No fix listed |
| f5 big-ip access policy manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip access policy manager | >= 12.1.0, <= 12.1.4 | No fix listed |
Show 76 more
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip access policy manager | >= 13.1.0, <= 13.1.1 | No fix listed |
| f5 big-ip access policy manager | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip access policy manager | = 15.0.0 | No fix listed |
| f5 big-ip application security manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip application security manager | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip application security manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip application security manager | >= 14.0.0, <= 14.1.1 | No fix listed |
| f5 big-ip application security manager | = 15.0.0 | No fix listed |
| f5 big-ip edge gateway | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip edge gateway | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip edge gateway | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip edge gateway | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip edge gateway | = 15.0.0 | No fix listed |
| f5 big-ip fraud protection service | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip fraud protection service | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip fraud protection service | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip fraud protection service | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip fraud protection service | = 15.0.0 | No fix listed |
| f5 big-ip global traffic manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip global traffic manager | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip global traffic manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip global traffic manager | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip global traffic manager | = 15.0.0 | No fix listed |
| f5 big-ip link controller | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip link controller | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip link controller | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip link controller | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip link controller | = 15.0.0 | No fix listed |
| f5 big-ip webaccelerator | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip webaccelerator | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip webaccelerator | >= 13.1.0, <= 13.1.1 | No fix listed |
| f5 big-ip webaccelerator | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip webaccelerator | = 15.0.0 | No fix listed |
| f5 big-ip policy enforcement manager | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip policy enforcement manager | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip policy enforcement manager | >= 13.1.0, <= 13.1.1 | No fix listed |
| f5 big-ip policy enforcement manager | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip policy enforcement manager | = 15.0.0 | No fix listed |
| isc bind | >= 9.9.0, <= 9.10.8 | No fix listed |
| isc bind | >= 9.11.0, <= 9.11.6 | No fix listed |
| isc bind | >= 9.12.0, <= 9.12.4 | No fix listed |
| isc bind | >= 9.13.0, <= 9.13.7 | No fix listed |
| isc bind | = 9.9.3-s1 | No fix listed |
| isc bind | = 9.10.8-p1 | No fix listed |
| isc bind | = 9.11.5-s3 | No fix listed |
| isc bind | = 9.11.5-s5 | No fix listed |
| isc bind | = 9.14.0 | No fix listed |
| f5 enterprise manager | = 3.1.1 | No fix listed |
| f5 big-iq centralized management | >= 5.0.0, <= 5.4.0 | No fix listed |
| f5 big-iq centralized management | >= 6.0.0, <= 6.1.0 | No fix listed |
| f5 iworkflow | = 2.3.0 | No fix listed |
| f5 big-ip domain name system | >= 11.5.2, <= 11.6.5 | No fix listed |
| f5 big-ip domain name system | >= 12.1.0, <= 12.1.4 | No fix listed |
| f5 big-ip domain name system | >= 13.1.0, <= 13.1.1 | No fix listed |
| f5 big-ip domain name system | >= 14.0.0, <= 14.1.0 | No fix listed |
| f5 big-ip domain name system | = 15.0.0 | No fix listed |
| alpine/bind(Alpine:v3.10) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.11) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.12) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.13) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.14) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.15) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.16) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.17) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.18) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.19) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.20) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.21) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.22) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.23) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.24) | >= 9.9.0, < 9.14.1-r0 | 9.14.1-r0 |
| alpine/bind(Alpine:v3.6) | >= 9.9.0, < 9.11.6_p1-r0 | 9.11.6_p1-r0 |
| alpine/bind(Alpine:v3.7) | >= 9.9.0, < 9.11.6_p1-r0 | 9.11.6_p1-r0 |
| alpine/bind(Alpine:v3.8) | >= 9.9.0, < 9.12.4_p1-r0 | 9.12.4_p1-r0 |
| alpine/bind(Alpine:v3.9) | >= 9.9.0, < 9.12.4_p1-r0 | 9.12.4_p1-r0 |
| isc BIND 9 | = BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 deve | No fix listed |
References
- Debian Security Tracker CVE-2018-5743 vendor-advisory
- kb.isc.org third-party-advisory
- support.f5.com
- www.synology.com
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking