CVE-2018-5743
Last modified
CVE-2018-5743 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. EPSS estimates a 6.40% chance of exploitation in the next 30 days.
Description
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| F5 | Big-Ip Local Traffic Manager | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Local Traffic Manager | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Local Traffic Manager | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Local Traffic Manager | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Local Traffic Manager | 15.0.0 | — |
| F5 | Big-Ip Application Acceleration Manager | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Application Acceleration Manager | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Application Acceleration Manager | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Application Acceleration Manager | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Application Acceleration Manager | 15.0.0 | — |
| F5 | Big-Ip Advanced Firewall Manager | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Advanced Firewall Manager | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Advanced Firewall Manager | >= 13.1.0, <= 13.1.1 | — |
| F5 | Big-Ip Advanced Firewall Manager | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Advanced Firewall Manager | 15.0.0 | — |
| F5 | Big-Ip Analytics | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Analytics | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Analytics | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Analytics | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Analytics | 15.0.0 | — |
| F5 | Big-Ip Access Policy Manager | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Access Policy Manager | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Access Policy Manager | >= 13.1.0, <= 13.1.1 | — |
| F5 | Big-Ip Access Policy Manager | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Access Policy Manager | 15.0.0 | — |
| F5 | Big-Ip Application Security Manager | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Application Security Manager | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Application Security Manager | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Application Security Manager | >= 14.0.0, <= 14.1.1 | — |
| F5 | Big-Ip Application Security Manager | 15.0.0 | — |
| F5 | Big-Ip Edge Gateway | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Edge Gateway | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Edge Gateway | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Edge Gateway | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Edge Gateway | 15.0.0 | — |
| F5 | Big-Ip Fraud Protection Service | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Fraud Protection Service | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Fraud Protection Service | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Fraud Protection Service | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Fraud Protection Service | 15.0.0 | — |
| F5 | Big-Ip Global Traffic Manager | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Global Traffic Manager | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Global Traffic Manager | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Global Traffic Manager | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Global Traffic Manager | 15.0.0 | — |
| F5 | Big-Ip Link Controller | >= 11.5.2, <= 11.6.5 | — |
| F5 | Big-Ip Link Controller | >= 12.1.0, <= 12.1.4 | — |
| F5 | Big-Ip Link Controller | >= 13.0.0, <= 13.1.1 | — |
| F5 | Big-Ip Link Controller | >= 14.0.0, <= 14.1.0 | — |
| F5 | Big-Ip Link Controller | 15.0.0 | — |
Showing 50 of 77 affected configurations. See NVD for the full list.
References
- https://kb.isc.org/docs/cve-2018-5743Third Party Advisory
- https://kb.isc.org/docs/cve-2018-5743Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-5743?
How severe is CVE-2018-5743?
How do I fix CVE-2018-5743?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-5737A problem with the implementation of the new serve-stale fea…5.9
- CVE-2018-5738Change #4777 (introduced in October 2017) introduced an unfo…5.3
- CVE-2018-5739An extension to hooks capabilities which debuted in Kea 1.4.…6.5
- CVE-2018-5740"deny-answer-aliases" is a little-used feature intended to h…7.5
- CVE-2018-5741To provide fine-grained controls over the ability to use Dyn…6.5
- CVE-2018-5742While backporting a feature for a newer branch of BIND9, Red…7.5
- CVE-2018-5744A failure to free memory can occur when processing messages …7.5
- CVE-2018-5745"managed-keys" is a feature which allows a BIND resolver to …4.9
- CVE-2018-5746Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
- CVE-2018-5747In Long Range Zip (aka lrzip) 0.631, there is a use-after-fr…5.5
- CVE-2018-5748qemu/qemu_monitor.c in libvirt allows attackers to cause a d…
- CVE-2018-5749install.php in Minecraft Servers List Lite before commit c1c…
Are you affected by CVE-2018-5743?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST