Log in Start free

Vulnerability · Published Aug 21, 2020 · Assigned by isc

CVE-2020-8624update-policy rules of type "subdomain" are enforced incorrectly

Medium 4.3

In plain English

A medium-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)3.8%top 9.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20bind9.16.6-r0ALPINE-CVE-2020-8624
Alpine:v3.21bind9.16.6-r0ALPINE-CVE-2020-8624
Alpine:v3.22bind9.16.6-r0ALPINE-CVE-2020-8624
Alpine:v3.23bind9.16.6-r0ALPINE-CVE-2020-8624
Alpine:v3.24bind9.16.6-r0ALPINE-CVE-2020-8624
Debian:12bind91:9.16.6-1DEBIAN-CVE-2020-8624
Debian:13bind91:9.16.6-1DEBIAN-CVE-2020-8624
Debian:14bind91:9.16.6-1DEBIAN-CVE-2020-8624

Affected products (as reported)

VendorProductVersions
ISC BIND9 9.9.12 – before unspecifiedunspecified – through 9.9.139.10.7 – before unspecifiedunspecified – through 9.10.89.11.3 – before unspecifiedunspecified – before 9.11.229.12.1 – before unspecifiedunspecified – before 9.16.6

References