Denial of Service Vulnerability in BIND Package: CVE-2020-8619
Summary
ALPINE-CVE-2020-8619: In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or mor... Affects bind versions < 9.16.4-r0. Fixed in 9.16.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS (Domain Name System) software that provides a way to translate human-readable domain names into IP addresses. It is essential for the functioning of the internet, allowing users to access websites using easy-to-remember domain names. BIND is known for its flexibility and robustness, but like any software, it can be susceptible to vulnerabilities. CVE-2020-8619 affects multiple versions of BIND, highlighting a potential denial of service risk under specific conditions.
Vulnerability Detail
CVE-2020-8619 is a vulnerability found in ISC BIND9 versions 9.11.14 to 9.11.19, 9.14.9 to 9.14.12, and 9.16.0 to 9.16.3. The vulnerability arises when a nameserver is not providing authoritative service for zones containing an empty non-terminal entry with an asterisk ('*') character. An attacker with the ability to change zone content could exploit this vulnerability to cause a denial of service. However, such an attack would require significant privileges and is considered unlikely due to its traceability.
How To Fix
Minimum fixed version
9.16.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the DNS server to trusted users only, thereby minimizing the risk of exploitation. Additionally, monitor your DNS records for any unauthorized changes.
Conclusion
CVE-2020-8619 represents a significant vulnerability in the BIND package that could lead to denial of service under specific conditions. It is crucial for users of affected versions to update to the patched version to mitigate the risk. Monitoring and restricting access can serve as effective temporary measures.
See every vulnerability recorded for bind →
FAQ
CVE-2020-8619 is a vulnerability in BIND that could allow an attacker to cause a denial of service under specific conditions.
Affected versions include BIND 9.11.14 to 9.11.19, 9.14.9 to 9.14.12, and 9.16.0 to 9.16.3.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, restrict access to your DNS server and monitor for unauthorized changes to mitigate the risk.
The CVSS score of CVE-2020-8619 is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
