Vulnerability · Published Jun 17, 2020 · Assigned by isc
CVE-2020-8618A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer
Medium 4.9
In plain English
A medium-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)1.9%top 20.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | bind | 9.16.4-r0 | ALPINE-CVE-2020-8618 |
| Alpine:v3.21 | bind | 9.16.4-r0 | ALPINE-CVE-2020-8618 |
| Alpine:v3.22 | bind | 9.16.4-r0 | ALPINE-CVE-2020-8618 |
| Alpine:v3.23 | bind | 9.16.4-r0 | ALPINE-CVE-2020-8618 |
| Alpine:v3.24 | bind | 9.16.4-r0 | ALPINE-CVE-2020-8618 |
| Debian:12 | bind9 | 1:9.16.4-1 | DEBIAN-CVE-2020-8618 |
| Debian:13 | bind9 | 1:9.16.4-1 | DEBIAN-CVE-2020-8618 |
| Debian:14 | bind9 | 1:9.16.4-1 | DEBIAN-CVE-2020-8618 |
Affected products (as reported)
References
- https://kb.isc.org/docs/cve-2020-8618 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200625-0003/ x_refsource_CONFIRM
- USN-4399-1 vendor-advisory, x_refsource_UBUNTU
- openSUSE-SU-2020:1699 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1701 vendor-advisory, x_refsource_SUSE