Reachable Assertion in ISC BIND - CVE-2020-8622

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU45819

Reachable Assertion in ISC BIND - CVE-2020-8622

Published: August 20, 2020


Vulnerability identifier: #VU45819
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-8622
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when handling TSIG-signed request. An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit.


Affected software

ISC BIND
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
CentOS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Anolis OS
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
IBM AIX
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
HPE Helion Openstack
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
Slackware Linux
Opensuse
Junos OS
openEuler
Fedora
Cloud Pak for Security (CP4S)
IBM VIOS
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
bind (Alpine package)
bind (Red Hat package) main
bind9 (Debian package)
dnsperf
bind9 (Ubuntu package)
bind-debuginfo
bind-utils-debuginfo
bind-utils
bind-libs-debuginfo
bind-libs-debuginfo-32bit
bind-libs
bind-libs-32bit
bind-debugsource
bind-chrootenv
bind
bind-doc
bind-sdb-chroot
bind-pkcs11-utils
bind-sdb
bind-pkcs11-libs
bind-pkcs11-devel
bind-pkcs11
bind-lite-devel
bind-libs-lite
bind-license
bind-export-libs
bind-export-devel
bind-devel
bind-chroot
python3-bind
bind-dyndb-ldap
Data Computing Appliance (DCA)
Red Hat OpenShift Container Platform

How to mitigate CVE-2020-8622

Install updates from vendor's website.

ISC BIND - addressed in versions 9.11.22, 9.11.22-S1, 9.16.6, 9.17.4
Cloud Pak for Security (CP4S) - update to 1.8.0.0
bind (Alpine package) - update to 9.16.6-r0
bind (Red Hat package) main - addressed in versions 9.8.2-0.68.rc1.el6_10.8, 9.9.4-74.el7_6.5, 9.11.4-9.P2.el7_7.3, 9.11.4-26.P2.el7_9.2, 9.11.20-5.el8
bind9 (Debian package) - update to 9.11.5.P4+dfsg-5.1+deb10u2
Junos OS - addressed in versions 12.3X48-D95, 12.3R12-S15, 12.3R12-S19, 13.2X51-D40, 14.1X53-D30, 14.1X53-D53, 15.1x49-D190, 15.1R7-S6, 15.1R7-S9, 15.1R7-S10, 16.1R7-S6, 16.2R3, 17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.3R2-S5, 17.3R3-S6, 17.3R3-S11, 17.3R3-S12, 17.4R2-S7, 17.4R2-S12, 17.4R2-S13, 17.4R3, 17.4R3-S3, 17.4R3-S5, 18.1R3-S8, 18.1R3-S11, 18.1R3-S13, 18.2R2-S7, 18.2R2-S8, 18.2R3-S1, 18.2R3-S7, 18.2R3-S8, 18.3R1-S5, 18.3R2-S2, 18.3R3, 18.3R3-S4, 18.3R3-S5, 18.4R1-S4, 18.4R1-S8, 18.4R2-S1, 18.4R2-S7, 18.4R2-S10, 18.4R3, 18.4R3-S6, 18.4R3-S8, 18.4R3-S10, 19.1R1-S3, 19.1R1-S6, 19.1R2, 19.1R3, 19.1R3-S4, 19.1R3-S5, 19.1R3-S7, 19.1R3-S9, 19.2R1-S1, 19.2R1-S6, 19.2R1-S7, 19.2R1-S8, 19.2R1-S9, 19.2R2, 19.2R3-S1, 19.2R3-S2, 19.2R3-S4, 19.2R3-S5, 19.3R1, 19.3R2-S5, 19.3R2-S6, 19.3R3, 19.3R3-S1, 19.3R3-S2, 19.3R3-S4, 19.3R3-S5, 19.3R3-S6, 19.4R1-S4, 19.4R2, 19.4R2-S2, 19.4R2-S4, 19.4R2-S6, 19.4R2-S7, 19.4R2-S8, 19.4R3, 19.4R3-S3, 19.4R3-S6, 19.4R3-S7, 19.4R3-S8, 19.4R3-S9, 19.4R3-S10, 20.1R1, 20.1R2, 20.1R2-S2, 20.1R3, 20.1R3-S3, 20.1R3-S4, 20.2R1-S3, 20.2R2, 20.2R2-S3, 20.2R3, 20.2R3-S3, 20.2R3-S4, 20.2R3-S5, 20.2R3-S6, 20.3R1, 20.3R2, 20.3R3-S2, 20.3R3-S3, 20.3R3-S4, 20.3R3-S5, 20.3R3-S6, 20.4R1-S1, 20.4R2, 20.4R3, 20.4R3-S1, 20.4R3-S3, 20.4R3-S4, 20.4R3-S5, 20.4R3-S8, 21.1R1, 21.1R2, 21.1R3-S1, 21.1R3-S3, 21.1R3-S4, 21.2R1, 21.2R2-S1, 21.2R2-S2, 21.2R3, 21.2R3-S1, 21.2R3-S2, 21.2R3-S4, 21.2R3-S6, 21.3R2, 21.3R3-S1, 21.3R3-S3, 21.3R3-S5, 21.4R1, 21.4R1-S1, 21.4R2, 21.4R2-S1, 21.4R3, 21.4R3-S1, 21.4R3-S4, 22.1R1, 22.1R1-S2, 22.1R2, 22.1R2-S2, 22.1R3, 22.1R3-S3, 22.2R1, 22.2R1-S1, 22.2R2, 22.2R2-S1, 22.2R3, 22.2R3-S1, 22.3R1, 22.3R1-S1, 22.3R2, 22.3R2-S2, 22.3R3, 22.4R1, 22.4R2-S1, 22.4R3, 23.2R1
dnsperf - addressed in versions 2.3.4-2.fc31, 2.3.4-2.fc32
Data Computing Appliance (DCA) - update to 4.3.0.0
Red Hat OpenShift Container Platform - update to 4.5.20
bind9 (Ubuntu package) - addressed in versions 1:9.8.1.dfsg.P1-4ubuntu0.31, 1:9.9.5.dfsg-3ubuntu0.19+esm3, 1:9.10.3.dfsg.P4-8ubuntu1.17, 1:9.11.3+dfsg-1ubuntu1.13, 1:9.16.1-0ubuntu2.3
bind-debuginfo - update to 9.9.9P1-63.28.1
bind-utils-debuginfo - update to 9.9.9P1-63.28.1
bind-utils - update to 9.9.9P1-63.28.1
bind-libs-debuginfo - update to 9.9.9P1-63.28.1
bind-libs-debuginfo-32bit - update to 9.9.9P1-63.28.1
bind-libs - update to 9.9.9P1-63.28.1
bind-libs-32bit - update to 9.9.9P1-63.28.1
bind-debugsource - update to 9.9.9P1-63.28.1
bind-chrootenv - update to 9.9.9P1-63.28.1
bind - update to 9.9.9P1-63.28.1
bind-doc - update to 9.9.9P1-63.28.1
bind-sdb-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-utils - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-sdb - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11 - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-lite-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-libs-lite - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-utils - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-license - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-devel - update to 9.11.21-3
bind-utils - update to 9.11.21-3
bind-sdb-chroot - update to 9.11.21-3
bind-sdb - update to 9.11.21-3
bind-pkcs11-devel - update to 9.11.21-3
bind-pkcs11 - update to 9.11.21-3
bind-libs-lite - update to 9.11.21-3
bind-libs - update to 9.11.21-3
bind-export-libs - update to 9.11.21-3
bind-devel - update to 9.11.21-3
bind-debugsource - update to 9.11.21-3
bind-debuginfo - update to 9.11.21-3
bind-chroot - update to 9.11.21-3
python3-bind - update to 9.11.21-3
bind - update to 9.11.21-3
bind - addressed in versions 9.11.22-1.fc31, 9.11.22-1.fc32
python3-bind - update to 9.11.36-3
bind-dyndb-ldap - addressed in versions 11.2-4.fc31, 11.3-2.fc32

External References

Related Security Bulletins