PT-2020-5331 · Isc+8 · Bind+8
Tobias Klein
·
Published
2016-09-28
·
Updated
2025-12-07
·
CVE-2020-8617
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
BIND versions 9.0.0 through 9.11.18
BIND versions 9.12.0 through 9.12.4-P2
BIND versions 9.14.0 through 9.14.11
BIND versions 9.16.0 through 9.16.2
BIND versions 9.17.0 through 9.17.1
BIND all releases in 9.13 and 9.15 development branches
BIND versions 9.9.3-S1 through 9.11.18-S1
Description
The issue is related to a logic error in the code that checks TSIG validity, which can be exploited by an attacker to trigger an assertion failure in tsig.c, resulting in a denial of service. An attacker may potentially cause a BIND server to reach an inconsistent state if they know or successfully guess the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable.
Recommendations
For BIND versions 9.0.0 through 9.11.18, update to a version after 9.11.18 to resolve the issue.
For BIND versions 9.12.0 through 9.12.4-P2, update to a version after 9.12.4-P2 to resolve the issue.
For BIND versions 9.14.0 through 9.14.11, update to a version after 9.14.11 to resolve the issue.
For BIND versions 9.16.0 through 9.16.2, update to a version after 9.16.2 to resolve the issue.
For BIND versions 9.17.0 through 9.17.1, update to a version after 9.17.1 to resolve the issue.
For BIND all releases in 9.13 and 9.15 development branches, update to a version outside of these branches to resolve the issue.
For BIND versions 9.9.3-S1 through 9.11.18-S1, update to a version after 9.11.18-S1 to resolve the issue.
As a temporary workaround, consider disabling the
tsig.c function until a patch is available. Restrict access to the TSIG resource records to minimize the risk of exploitation. Avoid using the TSIG key in the affected BIND server until the issue is resolved.Exploit
Fix
DoS
Assertion Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Bind
Bind Server
Centos
Ibm Aix
Linuxmint
Red Hat
Suse
Ubuntu