CVE-2018-5741
Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation
02 Description
Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 3.45% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 88.9% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2019-01-16 20:00Z7 YR AGO
- Last updated
- 2024-09-17 02:26Z2 YR AGO
- Reserved
- 2018-01-17
- Assigning CNA
- isc
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.5)
- CNA CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- Data version
- 5.1
- Document digest
- 0f38cdf67aca5cbb23669fac3921cf556c60e3ec459289ec5fe1d3e8dc769f72
05 Affected products
06 References
- www.securityfocus.com105379http://www.securityfocus.com/bid/105379
- www.securitytracker.com1041674http://www.securitytracker.com/id/1041674
- kb.isc.orghttps://kb.isc.org/docs/cve-2018-5741
- security.gentoo.orgGLSA-201903-13https://security.gentoo.org/glsa/201903-13
- support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03927en_us
- access.redhat.comRHSA-2019:2057https://access.redhat.com/errata/RHSA-2019:2057
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190830-0001/
- lists.opensuse.orgopenSUSE-SU-2020:1699http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
- lists.opensuse.orgopenSUSE-SU-2020:1701http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
07 Remediation
At the time of public disclosure, ISC is not providing any code changing the behavior of the update-policy feature. While we believe that there are a few operators out there who are relying on the strictest interpretation permitted by the erroneous documentation, we have to balance that against changing the behavior of features in stable branches of BIND, including the 9.11 branch which is meant to be a feature-complete Extended Support Version of BIND 9. As a compromise between these conflicting priorities, we have decided that our best course of action is to disclose the error but leave the existing behavior of the krb5-subdomain and ms-subdomain policies as they are (while correcting the erroneous documentation). In maintenance releases issued during or after October 2018, the name field for ms-subdomain and krb5-subdomain will be corrected so that names lower than "." can be configured, and two new rule types will be added, krb5-selfsub and ms-selfsub, analogous to the existing selfsub rule type, which implement the behavior that was formerly described in the documentation for krb5-subdomain and ms-subdomain: restricting updates to names at or below the machine name encoded in the client's Windows or Kerberos principal.
08 Fixed in
Debian 12
- bind9 Fixed in 1:9.11.5+dfsg-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- bind9 Fixed in 1:9.11.5+dfsg-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- bind9 Fixed in 1:9.11.5+dfsg-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 14.04 LTS
- bind9 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 16.04 LTS
- bind9 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 18.04 LTS
- bind9 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.