CVSS: 7.5EPSS: 2%CPEs: 16EXPL: 0CVE-2020-8623 – A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c
https://notcve.org/view.php?id=CVE-2020-8623
21 Aug 2020 — In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker En BIND versiones 9.10.0 -) 9.11.21, 9.12.0 -) 9.16.5, 9.17.0 -) 9... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2020-8624 – update-policy rules of type "subdomain" are enforced incorrectly
https://notcve.org/view.php?id=CVE-2020-8624
21 Aug 2020 — In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone. En BIND versiones 9.9.12 -) 9.9.13, 9.10.7 -) 9.10.8, 9.11.3 -) 9.11.21, 9.12.1 -) 9.16.5, 9.17.0 -) 9.17.3, también afecta a ve... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-269: Improper Privilege Management CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.9EPSS: 5%CPEs: 11EXPL: 0CVE-2020-8619 – A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer
https://notcve.org/view.php?id=CVE-2020-8619
17 Jun 2020 — In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause deni... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-404: Improper Resource Shutdown or Release CWE-617: Reachable Assertion •
CVSS: 4.9EPSS: 2%CPEs: 5EXPL: 0CVE-2020-8618 – A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer
https://notcve.org/view.php?id=CVE-2020-8618
17 Jun 2020 — An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients. Un atacante al que se le permite enviar datos de zona a un servidor mediante la transferencia de zona puede explotar esto para provocar intencionalmente el fallo de aserción con una zona especialmente construida, negando el servicio a los clientes It was discovered that Bind incorrectly handled large respon... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-617: Reachable Assertion •
CVSS: 8.6EPSS: 3%CPEs: 20EXPL: 1CVE-2020-8616 – BIND does not sufficiently limit the number of fetches performed when processing referrals
https://notcve.org/view.php?id=CVE-2020-8616
19 May 2020 — A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to us... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 92%CPEs: 31EXPL: 5CVE-2020-8617 – A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
https://notcve.org/view.php?id=CVE-2020-8617
19 May 2020 — Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately e... • https://packetstorm.news/files/id/180550 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 5%CPEs: 11EXPL: 0CVE-2019-6477 – TCP-pipelined queries can bypass tcp-clients limit
https://notcve.org/view.php?id=CVE-2019-6477
21 Nov 2019 — With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered auth... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 1%CPEs: 5EXPL: 0CVE-2013-5661
https://notcve.org/view.php?id=CVE-2013-5661
05 Nov 2019 — Cache Poisoning issue exists in DNS Response Rate Limiting. Existe Un problema de envenenamiento de caché en el DNS Response Rate Limiting. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5661 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-6476 – An error in QNAME minimization code can cause BIND to exit with an assertion failure
https://notcve.org/view.php?id=CVE-2019-6476
17 Oct 2019 — A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4. Un defecto en el código agregado para soportar la minimización de QNAME puede causar que un nombrado salga con un error de aserción si un reenviador devuelve una referencia en lugar de resolver la consulta. Esto afecta a BIND versiones 9.14.0 hasta 9.14.6 y 9.15.0 hast... • https://kb.isc.org/docs/cve-2019-6476 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-6475 – A flaw in mirror zone validity checking can allow zone data to be spoofed
https://notcve.org/view.php?id=CVE-2019-6475
17 Oct 2019 — Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DNSSEC validation before being used in answers, as if it had been looked up via traditional recursion, and when mirror zone data cannot be validated, BIND falls back to using traditional recursion instead of the mirror zone. However, an error in the validity checks for the incoming zone data can allow an on-path ... • https://kb.isc.org/docs/cve-2019-6475 • CWE-345: Insufficient Verification of Data Authenticity •