Bug 1702541 (CVE-2018-5743)
| Summary: | CVE-2018-5743 bind: Limiting simultaneous TCP clients is ineffective | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> | ||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Petr Sklenar <psklenar> | ||||||||
| Severity: | high | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | unspecified | CC: | anon.amish, apmukher, dawwu, jlyle, jpopelka, mruprich, msehnout, mvanderw, pemensik, pzhukov, security-response-team, thozza, vonsch, yozone, zdohnal | ||||||||
| Target Milestone: | --- | Keywords: | Reopened, Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | bind 9.11.6-P1, bind 9.12.4-P1, bind 9.14.1, bind 9.11.7 | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: |
A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files. In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system.
|
Story Points: | --- | ||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2019-07-12 13:07:03 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1702554, 1702555, 1702556, 1702557, 1702558, 1702881, 1702882, 1744468, 1744469 | ||||||||||
| Bug Blocks: | 1702542 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Huzaifa S. Sidhpurwala
2019-04-24 05:29:40 UTC
Acknowledgments: Name: ISC Upstream: AT&T Created attachment 1557974 [details]
bind patch against 9.11.6
Created attachment 1557975 [details]
patch for 9.12.4
Created attachment 1557976 [details]
patch for 9.14.1
External References: https://kb.isc.org/docs/cve-2018-5743 Created bind tracking bugs for this issue: Affects: fedora-all [bug 1702881] Created bind99 tracking bugs for this issue: Affects: fedora-all [bug 1702882] Useful resource explaining how this CVE fix works and how is different from previous versions, is available on upstream KB[1]. 1. https://kb.isc.org/docs/how-does-tcp-clients-work This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:1145 https://access.redhat.com/errata/RHSA-2019:1145 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:1294 https://access.redhat.com/errata/RHSA-2019:1294 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:1492 https://access.redhat.com/errata/RHSA-2019:1492 Statement: This bind flaw can be exploited by a remote attacker (AV:N) by opening large number of simultaneous TCP client connections with the server. No special exploit code is required apart from the ability to open large number of TCP connections simultaneously either from one attacker machine or via some distributed attacker network (AC:L and PR:L). No user interaction is required from the server side (UI:N). The attacker can cause denial of service (A:H) by exhausting the file descriptor pool which named has access to. Also in cases where named process is not limited by OS-enforced per-process limits, this could cause exhaustion of available free file descriptors on the system running the named server causing denial of service for other processes running on that machine (S:C). This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-5743 Release notes mentioning CVE-2018-5743 fix: Experimental development branch 9.15.3: https://downloads.isc.org/isc/bind9/9.15.3/RELEASE-NOTES-bind-9.15.3.html This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Extended Update Support Via RHSA-2019:2698 https://access.redhat.com/errata/RHSA-2019:2698 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2019:2977 https://access.redhat.com/errata/RHSA-2019:2977 |