CVE-2020-8619MEDIUM
Description
In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.
References
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
https://kb.isc.org/docs/cve-2020-8619
https://security.netapp.com/advisory/ntap-20200625-0003/
Details
Source: MITRE
Published: 2020-06-17
Updated: 2020-10-20
Type: CWE-404
Risk Information
CVSS v2.0
Base Score: 4
Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 8
Severity: MEDIUM
CVSS v3.0
Base Score: 4.9
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 1.2
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from 9.11.14 to 9.11.19 (inclusive)
cpe:2.3:a:isc:bind:*:*:*:*:preview:*:*:* versions from 9.11.14-s1 to 9.11.19-s1 (inclusive)
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from 9.14.9 to 9.14.12 (inclusive)
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from 9.16.0 to 9.16.3 (inclusive)
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 148611 | EulerOS : bind (EulerOS-SA-2021-1725) | Nessus | Huawei Local Security Checks | medium |
| 148575 | EulerOS : bind (EulerOS-SA-2021-1739) | Nessus | Huawei Local Security Checks | medium |
| 147396 | NewStart CGSL MAIN 6.02 : bind Multiple Vulnerabilities (NS-SA-2021-0064) | Nessus | NewStart CGSL Local Security Checks | medium |
| 147084 | EulerOS Virtualization for ARM 64 3.0.6.0 : bind (EulerOS-SA-2021-1532) | Nessus | Huawei Local Security Checks | medium |
| 146246 | EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-1242) | Nessus | Huawei Local Security Checks | medium |
| 146237 | EulerOS : bind (EulerOS-SA-2021-1261) | Nessus | Huawei Local Security Checks | medium |
| 145782 | EulerOS 2.0 SP8 : bind (EulerOS-SA-2021-1134) | Nessus | Huawei Local Security Checks | medium |
| 143842 | SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2020:2914-1) | Nessus | SuSE Local Security Checks | medium |
| 142804 | Oracle Linux 8 : bind (ELSA-2020-4500) | Nessus | Oracle Linux Local Security Checks | medium |
| 142448 | RHEL 8 : bind (RHSA-2020:4500) | Nessus | Red Hat Local Security Checks | medium |
| 141839 | openSUSE Security Update : bind (openSUSE-2020-1701) | Nessus | SuSE Local Security Checks | medium |
| 141560 | openSUSE Security Update : bind (openSUSE-2020-1699) | Nessus | SuSE Local Security Checks | medium |
| 139930 | Debian DSA-4752-1 : bind9 - security update | Nessus | Debian Local Security Checks | medium |
| 139704 | F5 Networks BIG-IP : BIND vulnerability (K19807532) | Nessus | F5 Networks Local Security Checks | medium |
| 139047 | Photon OS 1.0: Bindutils PHSA-2020-1.0-0309 | Nessus | PhotonOS Local Security Checks | medium |
| 138817 | Photon OS 3.0: Bindutils PHSA-2020-3.0-0115 | Nessus | PhotonOS Local Security Checks | medium |
| 138815 | Photon OS 2.0: Bindutils PHSA-2020-2.0-0263 | Nessus | PhotonOS Local Security Checks | medium |
| 137865 | Fedora 31 : 32:bind (2020-5f8da4b260) | Nessus | Fedora Local Security Checks | medium |
| 137837 | ISC BIND 9.11.x < 9.11.20 / 9.11.14-S1 < 9.11.19-S9 / 9.14.x < 9.14.13 / 9.16.x < 9.16.4 DoS | Nessus | DNS | medium |
| 137765 | Fedora 32 : 32:bind (2020-54a91444ff) | Nessus | Fedora Local Security Checks | medium |
| 137699 | Slackware 14.0 / 14.1 / 14.2 / current : bind (SSA:2020-170-01) | Nessus | Slackware Local Security Checks | medium |
| 137692 | FreeBSD : BIND -- Remote Denial of Service vulnerability (f00d1873-b138-11ea-8659-901b0ef719ab) | Nessus | FreeBSD Local Security Checks | medium |
| 137625 | Ubuntu 20.04 : Bind vulnerabilities (USN-4399-1) | Nessus | Ubuntu Local Security Checks | medium |