Resource exhaustion in Isc Bind
CVE-2020-8616
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.106 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.106 · newest: 0.106 · change: 0.000
Affected products
- Isc Bind — versions 9.12.4, 9.9.3, 9.10.5
- Isc Bind9 — versions 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1
- Debian Linux — versions 9.0, 10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- kb.isc.org/docs/cve-2020-8616 (Patch, Vendor Advisory)
- www.nxnsattack.com (Exploit, Third Party Advisory)
- www.openwall.com/lists/oss-security/2020/05/19/4 (mailing-list, Patch, Mailing List, Third Party Advisory)
- www.debian.org/security/2020/dsa-4689 (vendor-advisory, Third Party Advisory)
- security.netapp.com/advisory/ntap-20200522-0002/
- usn.ubuntu.com/4365-2/ (vendor-advisory)
- www.synology.com/security/advisory/Synology_SA_20_12
- usn.ubuntu.com/4365-1/ (vendor-advisory)
- lists.debian.org/debian-lts-announce/2020/05/msg00031.html (mailing-list)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2020-8616?
- CVE-2020-8616 is a high-severity vulnerability in Isc Bind, classified under Uncontrolled Resource Consumption. CVSS score: 8.6/10. Published 2020-05-19.
- How severe is CVE-2020-8616?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2020-8616 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.