CVE-2020-8625high

CVE-2020-8625: high-severity vulnerability in ISC BIND9

A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

Published · Updated

Follow this CVE+ Monitor BIND9+ Monitor bind9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 64%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Enterprise Linux 5
workaround: As per upstream: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings, the vulnerable code path is NOT exposed…
Fixed
35 products (2,531 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.1) · Red Hat Enterprise Linux AppStream EUS (v. 8.2) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · and others 30
fix ↗
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 5
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ISC · BIND9
Related CVEs — ISC BIND9

In the same product, most dangerous first.

CVE-2020-8617HIGHA logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.cEPSS 93.3%CVE-2021-25216HIGHA second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 83.0%CVE-2021-25215HIGHAn assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itselfEPSS 11.7%CVE-2021-25219MEDIUMLame cache can be abused to severely degrade resolver performanceEPSS 11.2%CVE-2020-8616HIGHBIND does not sufficiently limit the number of fetches performed when processing referralsEPSS 10.9%CVE-2020-8623HIGHA flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cEPSS 6.6%