Vulnerability in BIND package (CVE-2020-8624)
Summary
CVE-2020-8624: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has... Affects bind across 8 version ranges.
>= 04ca7cc4b6993f47ea61852c759d047c83be7b3f, <= 079e9baebe7d2b42610b9d7bdc0f8a5f78bbe2d5
>= 4eb49c48823a2abbe0b3784305906cce5f520a4c, <= 3f3dd451af293119716d912c77a6da5918bf523a
< 9.16.6-r0
< 470cee7071b278e016ae94cd403dbc13689d3444
< 617639b7cc40ba9eb6fde2d98099726d50da812e
>= a37581543167cd471036b0d43e767c9ffb825625, <= 4ce7edb5801e41d14b0da003d97f81b0d73424c9
>= b2307b25465c16d37ff6de22438a2d214287417c, <= c00b4586ab21960bc2b13989f77ea8465e989187
>= db65d701b999d10e555c13454bceb74df4494975, <= 12f71327ff796ed24752a4286fc0b3d9b21a4a57
Fixed in 9.16.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND is an open-source software that provides DNS (Domain Name System) functionality. It is widely used as a DNS server and resolver. The vulnerability (CVE-2020-8624) affects versions 9.9.12 to 9.9.13, 9.10.7 to 9.10.8, 9.11.3 to 9.11.21, 9.12.1 to 9.16.5, and 9.17.0 to 9.17.3 of BIND, as well as the Supported Preview Edition versions 9.9.12-S1 to 9.9.13-S1 and 9.11.3-S1 to 9.11.21-S1. This vulnerability allows an attacker with specific privileges to modify unintended content within a zone.
Vulnerability Detail
The vulnerability (CVE-2020-8624) in BIND allows an attacker who has been granted privileges to change a specific subset of a zone's content to abuse these unintended additional privileges and update other contents of the zone. This can lead to unauthorized modifications to DNS records and potentially disrupt DNS resolution or redirect traffic to malicious destinations. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.16.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in BIND (CVE-2020-8624) allows an attacker to abuse unintended additional privileges and modify other contents of a zone. It is recommended to update BIND to version 9.16.6-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an open-source software that provides DNS functionality, serving as a DNS server and resolver.
The vulnerability affects versions 9.9.12 to 9.9.13, 9.10.7 to 9.10.8, 9.11.3 to 9.11.21, 9.12.1 to 9.16.5, and 9.17.0 to 9.17.3 of BIND, as well as the Supported Preview Edition versions 9.9.12-S1 to 9.9.13-S1 and 9.11.3-S1 to 9.11.21-S1.
An attacker with specific privileges can abuse the unintended additional privileges to modify other contents of a zone, potentially leading to unauthorized modifications to DNS records and disruption of DNS resolution.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
To fix this vulnerability, update BIND to version 9.16.6-r0 or later. Refer to the official documentation or consult your distribution's package manager for update instructions.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
