Critical Reflection Attack Vulnerability in BIND Package
Summary
ALPINE-CVE-2020-8616: A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to... Affects bind versions < 9.14.12-r0. Fixed in 9.14.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is one of the most widely used DNS server software, providing a robust and flexible solution for domain name resolution. It is known for its reliability and extensive feature set, including support for DNSSEC and dynamic updates. However, BIND is susceptible to vulnerabilities that can be exploited by malicious actors, potentially compromising server performance and security.
Vulnerability Detail
The vulnerability identified as CVE-2020-8616 arises from a lack of effective limitation on the number of fetches performed when processing DNS referrals. A malicious actor can exploit this by crafting specific referrals that cause a recursing server to issue an excessive number of fetches. This can lead to degraded performance of the server and can be leveraged in reflection attacks, where the server is used to amplify the attacker's traffic, resulting in a high amplification factor.
How To Fix
Minimum fixed version
9.14.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on DNS queries to mitigate the impact of potential reflection attacks. This can be done by configuring your firewall or DNS server settings to restrict the number of requests from a single source.
Conclusion
CVE-2020-8616 represents a significant risk to BIND users, with the potential for performance degradation and exploitation in reflection attacks. It is crucial to update to the patched version to safeguard against these threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bind →
FAQ
CVE-2020-8616 is a vulnerability in the BIND package that allows attackers to exploit the DNS referral processing mechanism, potentially leading to performance degradation and reflection attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-8616 is 8.6, indicating a high severity level.
The potential impacts include degraded server performance and the risk of being used in reflection attacks, which can amplify the attacker's traffic significantly.
Yes, the patched version of BIND is 9.14.12-r0. Updating to this version will mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
