Vulnerability record · CVE-2018-5740 · published 16 January 2019
CVE-2018-5740: BIND deny-answer-aliases assertion failure causes daemon crash
Isc · Bind
A defect in BIND's little-used "deny-answer-aliases" feature causes an assertion failure in name.c when the feature is enabled. Because the flaw is reachable over the network without authentication, a remote party can crash the named process, disrupting DNS resolution for everything the server serves. The feature is not enabled by default, so exposure is limited to operators who turned it on.
Description
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated crash of a core DNS service with a high EPSS score, though impact is limited to availability and only where a non-default feature is enabled.
What it is
A defect in BIND's little-used "deny-answer-aliases" feature causes an assertion failure in name.c when the feature is enabled. Because the flaw is reachable over the network without authentication, a remote party can crash the named process, disrupting DNS resolution for everything the server serves. The feature is not enabled by default, so exposure is limited to operators who turned it on.
Impact
An attacker can trigger an assertion failure that terminates the named daemon, causing a denial of service for all DNS clients relying on that resolver. There is no evidence of data disclosure or code execution; the CVSS vector shows availability impact only.
Attack surface
Reached over the network via DNS traffic against a recursive server that has deny-answer-aliases enabled; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. Servers with the feature disabled are not affected.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.60 (99th percentile), and references are vendor and third-party advisories with no public exploit tag.
What to do
- Upgrade BIND to a fixed release for your branch (9.9.13-P1, 9.10.8-P1, 9.11.4-P1, 9.12.2-P1, 9.13.3 or later as applicable) per the ISC advisory.
- If patching cannot be done immediately, disable the deny-answer-aliases option in named.conf to remove the vulnerable code path.
- Apply the vendor errata for your distribution (Red Hat, Debian, Ubuntu, openSUSE, Gentoo, NetApp, HP) rather than building from source where packages exist.
- Inventory recursive resolvers and confirm which ones actually have deny-answer-aliases configured, since only those are exposed.
- Monitor named process restarts and core dumps as an interim compensating control.
Detection
- Alert on unexpected named process termination or restart, and inspect core dumps for assertion failures in name.c.
- Search named.conf and configuration management for deny-answer-aliases to identify exposed resolvers.
- Correlate DNS query logs with crash timestamps to identify the triggering client or query pattern.
- Track BIND version strings across resolvers to find hosts still on affected 9.7.0 through 9.13.2 releases.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-5740 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-5740), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
