CVE-2018-5743

Public on 2019-06-25
Modified on 2019-07-25
Description
A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files. In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system.
Severity
Important
CVSS v3 Base Score
8.6
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 2 bind 2019-06-25 21:06 ALAS2-2019-1231
Amazon Linux 1 bind 2019-07-17 23:52 ALAS-2019-1244

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD CVSSv2 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
NVD CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H