Log in Start free

Vulnerability · Published Jun 17, 2020 · Assigned by isc

CVE-2020-8619A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

Medium 4.9

In plain English

A medium-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)2.1%top 17.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20bind9.16.4-r0ALPINE-CVE-2020-8619
Alpine:v3.21bind9.16.4-r0ALPINE-CVE-2020-8619
Alpine:v3.22bind9.16.4-r0ALPINE-CVE-2020-8619
Alpine:v3.23bind9.16.4-r0ALPINE-CVE-2020-8619
Alpine:v3.24bind9.16.4-r0ALPINE-CVE-2020-8619
Debian:12bind91:9.16.4-1DEBIAN-CVE-2020-8619
Debian:13bind91:9.16.4-1DEBIAN-CVE-2020-8619
Debian:14bind91:9.16.4-1DEBIAN-CVE-2020-8619

Affected products (as reported)

VendorProductVersions
ISC BIND9 9.11.14 through versions before 9.11.209.16.0 through versions before 9.16.49.11.14-S1 through versions before 9.11.20-S19.14.9 through versions 9.14.12

References