ISC BIND up to 9.13.6 Managed Key risky encryption

Summaryinfo

A vulnerability categorized as problematic has been discovered in ISC BIND up to 9.10.8-P1/9.11.5-P1/9.11.5-S3/9.12.3-P1/9.13.6. This affects an unknown part of the component Managed Key Handler. Executing a manipulation can lead to risky encryption. This vulnerability is registered as CVE-2018-5745. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in ISC BIND up to 9.10.8-P1/9.11.5-P1/9.11.5-S3/9.12.3-P1/9.13.6 (Domain Name Software). This vulnerability affects an unknown functionality of the component Managed Key Handler. The manipulation with an unknown input leads to a risky encryption vulnerability. The CWE definition for the vulnerability is CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. As an impact it is known to affect availability. CVE summarizes:

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

The bug was discovered 02/21/2019. The weakness was published 10/09/2019 (Website). The advisory is shared for download at kb.isc.org. This vulnerability was named CVE-2018-5745 since 01/17/2018. The attack can be initiated remotely. The successful exploitation needs a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

The vulnerability was handled as a non-public zero-day exploit for at least 230 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 176691 (Debian Security Update for bind9 (DLA 1697-1)).

Upgrading eliminates this vulnerability.

Similar entries are available at VDB-143199 and VDB-143198. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Domain Name Software

Vendor

• ISC

Name

• BIND

Version

• 9.10.8-P1
• 9.11.5-P1
• 9.11.5-S3
• 9.12.3-P1
• 9.13.0
• 9.13.1
• 9.13.2
• 9.13.3
• 9.13.4
• 9.13.5
• 9.13.6

License

• open-source

Website

• Vendor: https://www.isc.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion