Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2872
BIND DNS server resolves multiple assertion failures in
version 9.16.6 and 9.11.22
21 August 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: BIND
Publisher: BIND
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-8620
Original Bulletin:
https://kb.isc.org/docs/cve-2020-8620
https://kb.isc.org/docs/cve-2020-8621
https://kb.isc.org/docs/cve-2020-8622
https://kb.isc.org/docs/cve-2020-8623
https://kb.isc.org/docs/cve-2020-8624
Comment: This bulletin contains five (5) BIND security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
CVE: CVE-2020-8620
Document version: 2.0
Posting date: 20 August 2020
Program impacted: BIND
Versions affected: BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3
Severity: Medium
Exploitable: Remotely
Description:
In versions of BIND that use the libuv network manager (9.16.x is the only
stable branch affected) an incorrectly specified maximum buffer size allows
a specially crafted large TCP payload to trigger an assertion failure when
it is received.
Impact:
An attacker who can establish a TCP connection with the server and send data
on that connection can exploit this to trigger the assertion failure,
causing the server to exit.
CVSS Score: 6.7
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
For more information on the Common Vulnerability Scoring System and to obtain
your specific environmental score please visit:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1.
Workarounds:
No workarounds known.
Active exploits:
We are not aware of any active exploits.
Solution:
Upgrade to the patched release most closely related to your current version
of BIND:
- BIND 9.16.6
- BIND 9.17.4
Acknowledgments:
ISC would like to thank Emanuel Almeida of Cisco Systems, Inc. for bringing
this vulnerability to our attention.
Document revision history:
1.0 Early Notification, 12 August 2020
1.1 Updated Posting Date, 17 August 2020
2.0 Public Announcement, 20 August 2020
- --------------------------------------------------------------------------------
CVE: CVE-2020-8621
Document version: 2.0
Posting date: 20 August 2020
Program impacted: BIND
Versions affected: BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3
Severity: Medium
Exploitable: Remotely
Description:
While query forwarding and QNAME minimization are mutually incompatible,
BIND did sometimes allow QNAME minimization when continuing with recursion
after 'forward first' did not result in an answer. In these cases the data
used by QNAME minimization might be inconsistent, leading to an assertion
failure, causing the server to exit.
Impact:
If a server is configured with both QNAME minimization and 'forward first'
then an attacker who can send queries to it may be able to trigger the
condition that will cause the server to crash.
Servers that 'forward only' are not affected.
CVSS Score: 6.7
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
For more information on the Common Vulnerability Scoring System and to obtain
your specific environmental score please visit:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1.
Workarounds:
No workarounds known.
Active exploits:
We are not aware of any active exploits.
Solution:
Upgrade to the patched release most closely related to your current version
of BIND:
- BIND 9.16.6
- BIND 9.17.4
Acknowledgments:
ISC would like to thank Joseph Gullo for bringing this vulnerability to our
attention.
Document revision history:
1.0 Early Notification, 12 August 2020
1.1 Updated Posting Date, 17 August 2020
2.0 Public Announcement, 20 August 2020
- --------------------------------------------------------------------------------
CVE: CVE-2020-8622
Document version: 2.0
Posting date: 20 August 2020
Program impacted: BIND
Versions affected: BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3,
also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND Supported
Preview Edition
Severity: Medium
Exploitable: Remotely
Description:
Attempting to verify a truncated response to a TSIG-signed request leads to
an assertion failure.
Impact:
An attacker on the network path for a TSIG-signed request, or operating the
server receiving the TSIG-signed request, could send a truncated response to
that request, triggering an assertion failure, causing the server to exit.
Alternately, an off-path attacker would have to correctly guess when a
TSIG-signed request was sent, along with other characteristics of the packet
and message, and spoof a truncated response to trigger an assertion failure,
causing the server to exit.
CVSS Score: 5.9
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
For more information on the Common Vulnerability Scoring System and to obtain
your specific environmental score please visit:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1.
Workarounds:
No workarounds known.
Active exploits:
We are not aware of any active exploits.
Solution:
Upgrade to the patched release most closely related to your current version
of BIND:
- BIND 9.11.22
- BIND 9.16.6
- BIND 9.17.4
BIND Supported Preview Edition is a special feature preview branch of BIND
provided to eligible ISC support customers.
- BIND 9.11.22-S1
Acknowledgments:
ISC would like to thank Dave Feldman, Jeff Warren, and Joel Cunningham of
Oracle for bringing this vulnerability to our attention.
Document revision history:
1.0 Early Notification, 12 August 2020
1.1 Updated Posting Date, 17 August 2020
2.0 Public Announcement, 20 August 2020
- --------------------------------------------------------------------------------
CVE: CVE-2020-8623
Document version: 2.0
Posting date: 20 August 2020
Program impacted: BIND
Versions affected: BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5,
9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1
of the BIND 9 Supported Preview Edition
Severity: Medium
Exploitable: Remotely
Description:
If BIND is built with "--enable-native-pkcs11" then a specially crafted
query for a zone signed with RSA can trigger an assertion failure.
Impact:
An attacker that can reach a vulnerable system with a specially crafted
query packet can trigger a crash.
To be vulnerable, the system must:
- be running BIND that was built with "--enable-native-pkcs11"
- be signing one or more zones with an RSA key
- be able to receive queries from a possible attacker
CVSS Score: 6.7
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
For more information on the Common Vulnerability Scoring System and to obtain
your specific environmental score please visit:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1.
Workarounds:
No workarounds known.
Active exploits:
We are not aware of any active exploits.
Solution:
Upgrade to the patched release most closely related to your current version
of BIND:
- BIND 9.11.22
- BIND 9.16.6
- BIND 9.17.4
BIND Supported Preview Edition is a special feature preview branch of BIND
provided to eligible ISC support customers.
- BIND 9.11.22-S1
Acknowledgments:
ISC would like to thank Lyu Chiy for bringing this vulnerability to our
attention.
Document revision history:
1.0 Early Notification, 12 August 2020
1.1 Updated Posting Date, 17 August 2020
2.0 Public Announcement, 20 August 2020
- --------------------------------------------------------------------------------
CVE: CVE-2020-8624
Document version: 2.0
Posting date: 20 August 2020
Program impacted: BIND
Versions affected: BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8,
9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3,
also affects 9.9.12-S1 -> 9.9.13-S1,
9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported
Preview Edition
Severity: Low
Exploitable: Remotely
Description:
Change 4885 inadvertently caused "update-policy" rules of type "subdomain"
to be treated as if they were of type "zonesub", allowing updates to all
parts of the zone along with the intended subdomain.
Impact:
An attacker who has been granted privileges to change a specific subset of
the zone's content could abuse these unintended additional privileges to
update other contents of the zone.
CVSS Score: 3.9
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
For more information on the Common Vulnerability Scoring System and to obtain
your specific environmental score please visit:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C&version=3.1.
Workarounds:
No workarounds known.
Active exploits:
We are not aware of any active exploits but the issue has been
described on a public bug tracker for a Linux distribution.
Solution:
Upgrade to the patched release most closely related to your current version
of BIND:
- BIND 9.11.22
- BIND 9.16.6
- BIND 9.17.4
BIND Supported Preview Edition is a special feature preview branch of BIND
provided to eligible ISC support customers.
- BIND 9.11.22-S1
Acknowledgments:
ISC would like to thank Joop Boonen of credativ GmbH for bringing this
vulnerability to our attention.
Document revision history:
1.0 Early Notification, 12 August 2020
1.1 Updated Posting Date, 17 August 2020
2.0 Public Announcement, 20 August 2020
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXz8WpeNLKJtyKPYoAQi1nRAAlTaciCduz080DpWwth1ZSYOpUEShFF6s
+QWW5Kxhng2qmEu1lbrQQa1QruWzHNP/QKGrUpijEgm9x8x+YzCDsI5r5+tzVESh
1ZyfacO8lob+hCX7punWaPDE4Jx7n6pFVqVgcJqXojFPsaPtOQkJtCgdBfQbNsMN
DmKbT/hSaKeW9XefjWi2DOnWvLlWmIVG6qA7YI8hJlaUev+V/M1/SHtD2UttOodL
MjJfCP/oNCpmRbirhWZLcJh1cqkI4OvJvZsrPuXrXKnxOuuxiv/Y42Sz8gV7F5GN
HIy9YhnLLpu0TOF5DPCxCa1Y0eSCiZv306cma16v1vEBD44kCLqiAksRIXonHdy9
Ftjj+KzWm3M++ufdEL9TII0cDyeDxv/TNml+ZD3l4OsimRZQhGsmX6QaVhGO8ESs
JpU2sjCvN8wur0Sl0rzlII55BpujuwrxM37ePtfSZYza33QOo/WpJEYskswOPRyb
gF9caKSEhorgFsaJrfVyMFgLZEr2NOJYpxU4cbRwfZRsMSGhdvsbiviK/gsJECj2
F8xzyVZ5nJfCBXn/tvtHiFpDwEPv847Wr4zQmyALgEBbdmO+qH8cWtSiIouqJS+i
XC9WIH80+8XIiBMIB7wSBOpreQbRRixx+jY+UgjstG7lmk1QMSWOLhJwhN4+jdP9
TuidaoFpGE0=
=kKlZ
-----END PGP SIGNATURE-----