CVE-2020-8624 update-policy rules of type "subdomain" are enforced incorrectly

What is CVE-2020-8624?

CVE-2020-8624 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 21 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Weakness: CWE-269

Which versions are affected by CVE-2020-8624?

It affects 6 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Isc Bind, Netapp Steelstore Cloud Integrated Storage, Opensuse Leap.

How do I fix CVE-2020-8624?

Upgrade to a fixed version.

Is CVE-2020-8624 being exploited?

There is no known exploitation of CVE-2020-8624 in the wild and no public exploit code.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2020-11651 SaltStack Salt Authentication Bypass Exploited Critical 9.8
• CVE-2020-7247 OpenSMTPD Remote Code Execution Exploited Critical 9.8
• CVE-2019-16928 Exim Out-of-bounds Write Exploited Critical 9.8
• CVE-2018-6789 Exim Buffer Overflow Exploited Critical 9.8
• CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code Execution Exploited Critical 9.8

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2020-8624, DEBIAN-CVE-2020-8624, GHSA-qgv6-6x66-mr9j, UBUNTU-CVE-2020-8624.