Critical Vulnerability in BIND Package: Assertion Failure Exploit
Summary
ALPINE-CVE-2020-8620: In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit. Affects bind versions < 9.16.6-r0. Fixed in 9.16.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a robust and flexible solution for domain name resolution. It is known for its reliability and extensive feature set, making it a staple in many network infrastructures. However, certain versions of BIND are susceptible to a critical vulnerability that can lead to server crashes, impacting service availability.
Vulnerability Detail
In BIND versions 9.15.6 to 9.16.5 and 9.17.0 to 9.17.3, an attacker who can establish a TCP connection with the server can exploit this vulnerability by sending crafted data. This can trigger an assertion failure, causing the server to exit unexpectedly. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level, and poses significant risks to the stability and availability of DNS services.
How To Fix
Minimum fixed version
9.16.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the BIND server to trusted IP addresses only. This can be done by configuring firewall rules to limit TCP connections to the server, thereby reducing the risk of exploitation until the package is updated.
Conclusion
The BIND package has a critical vulnerability that can lead to server crashes if exploited. It is crucial to update to the patched version to ensure the stability and security of DNS services. Implementing temporary workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for bind →
FAQ
The vulnerability can lead to an assertion failure, causing the BIND server to crash, which disrupts DNS services.
You can check your BIND version by running the command named -v in your terminal. If it falls within the affected versions, you should take action.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application against known vulnerabilities using the Vulert playground.
If an immediate update is not possible, implement firewall rules to restrict access to the BIND server to trusted IP addresses as a temporary workaround.
Detailed information can be found in the CVE database or by visiting the official BIND documentation and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
