CVE-2020-8617 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
An attacker can cause a BIND DNS server to crash by sending a specially crafted message that triggers an assertion failure in TSIG validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8617?
CVE-2020-8617 is a high-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 19 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
Weakness: CWE-617
Which versions are affected by CVE-2020-8617?
It affects 5 products.
Linux distribution packages (34)
bind Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-chroot Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-debuginfo Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-devel Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-export-devel Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-export-libs Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-libs Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-libs-lite Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-license Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-lite-devel Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11 Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11-devel Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11-libs Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11-utils Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-sdb Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-sdb-chroot Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-utils Red Hat:rhel_eus:7.7::computenode | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-chroot Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-devel Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-export-devel Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-export-libs Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-libs Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-libs-lite Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-license Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-lite-devel Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11 Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11-devel Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11-libs Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-pkcs11-utils Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-sdb Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-sdb-chroot Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
bind-utils Red Hat:rhel_eus:7.7::server | All versions | 32:9.11.4-9.P2.el7_7.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Isc Bind, Opensuse Leap.
How do I fix CVE-2020-8617?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-8617 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-8617 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2020-8617, DEBIAN-CVE-2020-8617, GHSA-q6g5-8p95-hqh7, RHSA-2020:2893, UBUNTU-CVE-2020-8617.