CVE-2020-8621

MEDIUM

Description

In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.

References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html

https://kb.isc.org/docs/cve-2020-8621

https://security.gentoo.org/glsa/202008-19

https://security.netapp.com/advisory/ntap-20200827-0003/

https://usn.ubuntu.com/4468-1/

https://www.synology.com/security/advisory/Synology_SA_20_19

Details

Source: MITRE

Published: 2020-08-21

Updated: 2020-10-20

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from 9.14.0 to 9.16.5 (inclusive)

cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from 9.17.0 to 9.17.3 (inclusive)

Tenable Plugins

View all (6 total)

IDNameProductFamilySeverity
143842SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2020:2914-1)NessusSuSE Local Security Checks
medium
141839openSUSE Security Update : bind (openSUSE-2020-1701)NessusSuSE Local Security Checks
medium
141560openSUSE Security Update : bind (openSUSE-2020-1699)NessusSuSE Local Security Checks
medium
140067GLSA-202008-19 : BIND: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
139916ISC BIND 9.14.x < 9.16.6, 9.17.x < 9.17.4 DoSNessusDNS
medium
139770Ubuntu 16.04 LTS / 18.04 LTS / 20.04 : Bind vulnerabilities (USN-4468-1)NessusUbuntu Local Security Checks
medium