CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2020-8622 – A truncated TSIG response can lead to an assertion failure
https://notcve.org/view.php?id=CVE-2020-8622
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit. En BIND versiones 9.0.0 -) 9.11.21, 9.12.0 -) 9.16.5, 9.17.0 -) 9.17.3, también afecta a versiones 9.9.3-S1 -) 9.11.21-S1 de BIND 9 Supported Preview Edition, un atacante sobre la ruta de la red para una petición firmada por TSIG, u operando el servidor que recibe la petición firmada por TSIG, podría enviar una respuesta truncada a esa petición, desencadenando un fallo de aserción y causando que el servidor salga. Alternativamente, un atacante fuera de la ruta tendría que adivinar correctamente cuándo fue enviada una petición firmada por TSIG, junto con otras características del paquete y mensaje, y falsificar una respuesta truncada para desencadenar un fallo de aserción, causando la salida del servidor. A flaw was found in bind. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html https://kb.isc.org/docs/cve-2020-8622 https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP https://security. • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-8621 – Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c
https://notcve.org/view.php?id=CVE-2020-8621
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected. En BIND versiones 9.14.0 -) 9.16.5, 9.17.0 -) 9.17.3, si un servidor está configurado con minimización de QNAME y "forward first", entonces un atacante que pueda enviarle consultas puede ser capaz de desencadenar la condición que causará que el servidor se bloquee. Los servidores con "forward only" no están afectados. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html https://kb.isc.org/docs/cve-2020-8621 https://security.gentoo.org/glsa/202008-19 https://security.netapp.com/advisory/ntap-20200827-0003 https://usn.ubuntu.com/4468-1 https://www.synology.com/security/advisory/Synology_SA_20_19 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 2%CPEs: 12EXPL: 0CVE-2020-8620
https://notcve.org/view.php?id=CVE-2020-8620
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit. En BIND versiones 9.15.6 -) 9.16.5, 9.17.0 -) 9.17.3, un atacante que puede establecer una conexión TCP con el servidor y enviar datos en esa conexión puede explotar esto para desencadenar el fallo de aserción, causando la salida del servidor. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html https://kb.isc.org/docs/cve-2020-8620 https://security.gentoo.org/glsa/202008-19 https://security.netapp.com/advisory/ntap-20200827-0003 https://usn.ubuntu.com/4468-1 https://www.synology.com/security/advisory/Synology_SA_20_19 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 97%CPEs: 31EXPL: 2CVE-2020-8617 – A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
https://notcve.org/view.php?id=CVE-2020-8617
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results. Al usar un mensaje especialmente diseñado, un atacante puede causar que un servidor BIND alcance un estado inconsistente si el atacante conoce (o adivina con éxito) el nombre de una clave TSIG utilizada por el servidor. • https://www.exploit-db.com/exploits/48521 https://github.com/knqyf263/CVE-2020-8617 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html http://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html http://www.openwall.com/lists/oss-security/2020/05/19/4 https://kb.isc.org/docs/cve-2020-8617 https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html https:/ • CWE-617: Reachable Assertion •
CVSS: 8.6EPSS: 1%CPEs: 20EXPL: 1CVE-2020-8616 – BIND does not sufficiently limit the number of fetches performed when processing referrals
https://notcve.org/view.php?id=CVE-2020-8616
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. Un actor malicioso que explota intencionalmente esta falta de limitación efectiva en el número de recuperaciones realizadas cuando se procesan referencias puede, mediante el uso de referencias especialmente diseñadas, causar que un servidor recurrente emita una gran cantidad de recuperaciones en un intento de procesar la referencia. Esto tiene al menos dos efectos potenciales: el rendimiento del servidor recurrente puede estar potencialmente afectado por el trabajo adicional requerido para realizar estas recuperaciones, y el atacante puede explotar este comportamiento para utilizar el servidor recurrente como un reflector en un ataque de reflexión con un alto factor de amplificación A flaw was found in BIND, where it does not sufficiently limit the number of fetches that can be performed while processing a referral response. This flaw allows an attacker to cause a denial of service attack. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html http://www.nxnsattack.com http://www.openwall.com/lists/oss-security/2020/05/19/4 https://kb.isc.org/docs/cve-2020-8616 https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ https://lists.fedoraproject.org/archi • CWE-400: Uncontrolled Resource Consumption •