Reachable Assertion in ISC BIND - CVE-2020-8622

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU45819

Reachable Assertion in ISC BIND - CVE-2020-8622

Published: August 20, 2020


Vulnerability identifier: #VU45819
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-8622
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when handling TSIG-signed request. An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit.


Affected software

ISC BIND
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Anolis OS
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM System z (Structure A)
IBM AIX
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
Slackware Linux
Opensuse
Junos OS
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
bind (Red Hat package) main
bind (Alpine package)
bind9 (Debian package)
bind9 (Ubuntu package)
dnsperf
bind-debuginfo
bind-utils-debuginfo
bind-utils
bind-libs-debuginfo
bind-libs-debuginfo-32bit
bind-libs
bind-libs-32bit
bind-debugsource
bind-chrootenv
bind
bind-doc
bind-pkcs11-devel
bind-sdb
bind-sdb-chroot
bind-license
bind-pkcs11-utils
bind-pkcs11-libs
bind-pkcs11
bind-lite-devel
bind-libs-lite
bind-export-libs
bind-export-devel
bind-devel
bind-chroot
python3-bind
bind-dyndb-ldap
Cloud Pak for Security (CP4S)
IBM VIOS
Data Computing Appliance (DCA)
Red Hat OpenShift Container Platform

How to mitigate CVE-2020-8622

Install updates from vendor's website.

ISC BIND - addressed in versions 9.11.22, 9.11.22-S1, 9.16.6, 9.17.4
bind (Red Hat package) main - addressed in versions 9.8.2-0.68.rc1.el6_10.8, 9.9.4-74.el7_6.5, 9.11.4-9.P2.el7_7.3, 9.11.4-26.P2.el7_9.2, 9.11.20-5.el8
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Junos OS - addressed in versions 12.3X48-D95, 12.3R12-S15, 12.3R12-S19, 13.2X51-D40, 14.1X53-D30, 14.1X53-D53, 15.1x49-D190, 15.1R7-S6, 15.1R7-S9, 15.1R7-S10, 16.1R7-S6, 16.2R3, 17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.3R2-S5, 17.3R3-S6, 17.3R3-S11, 17.3R3-S12, 17.4R2-S7, 17.4R2-S12, 17.4R2-S13, 17.4R3, 17.4R3-S3, 17.4R3-S5, 18.1R3-S8, 18.1R3-S11, 18.1R3-S13, 18.2R2-S7, 18.2R2-S8, 18.2R3-S1, 18.2R3-S7, 18.2R3-S8, 18.3R1-S5, 18.3R2-S2, 18.3R3, 18.3R3-S4, 18.3R3-S5, 18.4R1-S4, 18.4R1-S8, 18.4R2-S1, 18.4R2-S7, 18.4R2-S10, 18.4R3, 18.4R3-S6, 18.4R3-S8, 18.4R3-S10, 19.1R1-S3, 19.1R1-S6, 19.1R2, 19.1R3, 19.1R3-S4, 19.1R3-S5, 19.1R3-S7, 19.1R3-S9, 19.2R1-S1, 19.2R1-S6, 19.2R1-S7, 19.2R1-S8, 19.2R1-S9, 19.2R2, 19.2R3-S1, 19.2R3-S2, 19.2R3-S4, 19.2R3-S5, 19.3R1, 19.3R2-S5, 19.3R2-S6, 19.3R3, 19.3R3-S1, 19.3R3-S2, 19.3R3-S4, 19.3R3-S5, 19.3R3-S6, 19.4R1-S4, 19.4R2, 19.4R2-S2, 19.4R2-S4, 19.4R2-S6, 19.4R2-S7, 19.4R2-S8, 19.4R3, 19.4R3-S3, 19.4R3-S6, 19.4R3-S7, 19.4R3-S8, 19.4R3-S9, 19.4R3-S10, 20.1R1, 20.1R2, 20.1R2-S2, 20.1R3, 20.1R3-S3, 20.1R3-S4, 20.2R1-S3, 20.2R2, 20.2R2-S3, 20.2R3, 20.2R3-S3, 20.2R3-S4, 20.2R3-S5, 20.2R3-S6, 20.3R1, 20.3R2, 20.3R3-S2, 20.3R3-S3, 20.3R3-S4, 20.3R3-S5, 20.3R3-S6, 20.4R1-S1, 20.4R2, 20.4R3, 20.4R3-S1, 20.4R3-S3, 20.4R3-S4, 20.4R3-S5, 20.4R3-S8, 21.1R1, 21.1R2, 21.1R3-S1, 21.1R3-S3, 21.1R3-S4, 21.2R1, 21.2R2-S1, 21.2R2-S2, 21.2R3, 21.2R3-S1, 21.2R3-S2, 21.2R3-S4, 21.2R3-S6, 21.3R2, 21.3R3-S1, 21.3R3-S3, 21.3R3-S5, 21.4R1, 21.4R1-S1, 21.4R2, 21.4R2-S1, 21.4R3, 21.4R3-S1, 21.4R3-S4, 22.1R1, 22.1R1-S2, 22.1R2, 22.1R2-S2, 22.1R3, 22.1R3-S3, 22.2R1, 22.2R1-S1, 22.2R2, 22.2R2-S1, 22.2R3, 22.2R3-S1, 22.3R1, 22.3R1-S1, 22.3R2, 22.3R2-S2, 22.3R3, 22.4R1, 22.4R2-S1, 22.4R3, 23.2R1
bind (Alpine package) - update to 9.16.6-r0
bind9 (Debian package) - update to 9.11.5.P4+dfsg-5.1+deb10u2
bind9 (Ubuntu package) - addressed in versions 1:9.8.1.dfsg.P1-4ubuntu0.31, 1:9.9.5.dfsg-3ubuntu0.19+esm3, 1:9.10.3.dfsg.P4-8ubuntu1.17, 1:9.11.3+dfsg-1ubuntu1.13, 1:9.16.1-0ubuntu2.3
dnsperf - addressed in versions 2.3.4-2.fc31, 2.3.4-2.fc32
bind-debuginfo - update to 9.9.9P1-63.28.1
bind-utils-debuginfo - update to 9.9.9P1-63.28.1
bind-utils - update to 9.9.9P1-63.28.1
bind-libs-debuginfo - update to 9.9.9P1-63.28.1
bind-libs-debuginfo-32bit - update to 9.9.9P1-63.28.1
bind-libs - update to 9.9.9P1-63.28.1
bind-libs-32bit - update to 9.9.9P1-63.28.1
bind-debugsource - update to 9.9.9P1-63.28.1
bind-chrootenv - update to 9.9.9P1-63.28.1
bind - update to 9.9.9P1-63.28.1
bind-doc - update to 9.9.9P1-63.28.1
bind-pkcs11-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-sdb - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-sdb-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-utils - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-license - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-utils - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11 - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-lite-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-libs-lite - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind - update to 9.11.21-3
bind-utils - update to 9.11.21-3
bind-sdb-chroot - update to 9.11.21-3
bind-sdb - update to 9.11.21-3
bind-pkcs11-devel - update to 9.11.21-3
bind-pkcs11 - update to 9.11.21-3
bind-libs-lite - update to 9.11.21-3
bind-export-libs - update to 9.11.21-3
bind-export-devel - update to 9.11.21-3
bind-devel - update to 9.11.21-3
bind-debugsource - update to 9.11.21-3
bind-debuginfo - update to 9.11.21-3
bind-chroot - update to 9.11.21-3
bind-libs - update to 9.11.21-3
python3-bind - update to 9.11.21-3
bind - addressed in versions 9.11.22-1.fc31, 9.11.22-1.fc32
python3-bind - update to 9.11.36-3
bind-dyndb-ldap - addressed in versions 11.2-4.fc31, 11.3-2.fc32
Data Computing Appliance (DCA) - update to 4.3.0.0
Red Hat OpenShift Container Platform - update to 4.5.20

External References

Related Security Bulletins