CVE-2018-5735
📋 TL;DR
This vulnerability is an assertion failure in the BIND DNS server's validator component, specifically affecting Debian backports of a previous CVE-2017-3137 fix. It can cause the BIND server to crash when processing certain DNS responses, leading to denial of service. Only Debian systems with specific backported versions are affected.
💻 Affected Systems
- BIND DNS server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
DNS service becomes completely unavailable, disrupting all DNS resolution for dependent services and potentially causing cascading failures in network infrastructure.
Likely Case
Intermittent DNS server crashes requiring manual restart, causing temporary service disruptions and increased administrative overhead.
If Mitigated
Minimal impact with proper monitoring and automated restart mechanisms in place, though service interruptions may still occur during crashes.
🎯 Exploit Status
Exploitation requires sending specially crafted DNS responses to trigger the assertion failure. The vulnerability is in the validator component that processes DNS responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Debian security updates: DSA-4148-1 for Debian 8, DSA-4149-1 for Debian 9
Vendor Advisory: https://security-tracker.debian.org/tracker/CVE-2018-5735
Restart Required: Yes
Instructions:
1. Update package lists: sudo apt-get update
2. Upgrade BIND packages: sudo apt-get upgrade bind9
3. Restart BIND service: sudo systemctl restart bind9
🔧 Temporary Workarounds
Disable DNSSEC validation
linuxTemporarily disable DNSSEC validation to prevent triggering the assertion failure
Edit named.conf and set 'dnssec-validation no;' in options section
🧯 If You Can't Patch
- Implement network segmentation to restrict DNS traffic to trusted sources only
- Deploy redundant DNS servers with load balancing to maintain service during crashes
🔍 How to Verify
Check if Vulnerable:
Check BIND version: dpkg -l | grep bind9Check Version:
dpkg -l | grep bind9 | awk '{print $3}'Verify Fix Applied:
Verify version is not in affected list and check for security updates: apt-cache policy bind9📡 Detection & Monitoring
Log Indicators:
- BIND process crashes
- Assertion failures in validator.c:1858
- Unexpected BIND restarts
Network Indicators:
- Increased DNS query timeouts
- DNS resolution failures
SIEM Query:
source="bind" AND ("assertion failure" OR "validator.c:1858" OR "crash")