CVE-2020-8617: high-severity vulnerability in ISC BIND9
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
Published · Updated
80Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 93%
from disclosure to weapon1 days
Published on NVDMay 19
1st PoC+1d
metasploitMay 19
exploitation probability
93%top 1% of all CVEs
observed exploitation
nono source reports it
4 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
1 product (2 components)
Red Hat Enterprise Linux 5
workaround: BIND servers have an internally-generated TSIG session key whose name is trivially guessable, and that key exposes the vulnerability unless specifically disabled. Upstream recommends using random value in session-keyname as a workaround…
Fixed
50 products (2,918 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.1) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · Red Hat Enterprise Linux Client (v. 7) · and others 45
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
ISC · BIND9public PoCs found — 4
exploitdbwww.exploit-db.com/exploits/48521unverifiedgithubgithub.com/knqyf263/CVE-2020-8617★ 45githubgithub.com/gothburz/cve-2020-8617★ 0cve_referencepacketstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ISC BIND9
In the same product, most dangerous first.
CVE-2021-25216HIGHA second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 82.4%CVE-2020-8625HIGHA vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 64.2%CVE-2021-25215HIGHAn assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itselfEPSS 11.4%CVE-2020-8616HIGHBIND does not sufficiently limit the number of fetches performed when processing referralsEPSS 10.6%CVE-2021-25219MEDIUMLame cache can be abused to severely degrade resolver performanceEPSS 10.6%CVE-2020-8623HIGHA flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cEPSS 6.4%
References
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlhttp://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.htmlhttps://kb.isc.org/docs/cve-2020-8617https://lists.debian.org/debian-lts-announce/2020/05/msg00031.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/https://security.netapp.com/advisory/ntap-20200522-0002/https://usn.ubuntu.com/4365-1/https://usn.ubuntu.com/4365-2/https://www.debian.org/security/2020/dsa-4689http://www.openwall.com/lists/oss-security/2020/05/19/4