Resource exhaustion in Isc Bind
CVE-2020-8616
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.106 (95.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Isc Bind — versions 9.12.4, 9.9.3, 9.10.5
- Isc Bind9 — versions 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1
- Debian Debian_linux — versions 9.0, 10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-officer@isc.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-officer@isc.org (Exploit, Third Party Advisory, x_refsource_MISC)
- security-officer@isc.org (mailing-list, x_refsource_MLIST, Patch, Mailing List, Third Party Advisory)
- security-officer@isc.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- security-officer@isc.org (x_refsource_CONFIRM)
- security-officer@isc.org (x_refsource_UBUNTU, vendor-advisory)
- security-officer@isc.org (x_refsource_CONFIRM)
- security-officer@isc.org (x_refsource_UBUNTU, vendor-advisory)
- security-officer@isc.org (mailing-list, x_refsource_MLIST)
- security-officer@isc.org (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2020-8616?
- CVE-2020-8616 is a high-severity vulnerability in Isc Bind, classified under Uncontrolled Resource Consumption. CVSS score: 8.6/10. Published 2020-05-19.
- How severe is CVE-2020-8616?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2020-8616 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.