BIND Vulnerability: Inconsistent State Triggered by TSIG Key Manipulation
Summary
ALPINE-CVE-2020-8617: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Affects bind versions < 9.14.12-r0. Fixed in 9.14.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides domain name resolution services. It is known for its robustness and flexibility, supporting various DNS features and configurations. However, BIND has been found to be vulnerable to a specific issue where an attacker can exploit the server's handling of TSIG (Transaction Signature) keys, potentially leading to an inconsistent state in the server's operation.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to send a specially-crafted message to a BIND server, which may cause it to reach an inconsistent state if the attacker knows or guesses the name of a TSIG key used by the server. This issue affects almost all current BIND servers due to the default configuration that includes a local session key. In versions of BIND released from March 2018 onwards, an assertion check was introduced to detect this inconsistent state, causing the server to exit deliberately. Prior to this check, the server could continue operating in an inconsistent state, leading to potentially harmful consequences.
How To Fix
Minimum fixed version
9.14.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of TSIG keys in your BIND configuration if they are not necessary for your operations. This can be done by modifying the BIND configuration file (usually located at /etc/bind/named.conf) and removing or commenting out any TSIG key definitions.
Conclusion
In summary, the BIND vulnerability related to TSIG key manipulation poses a significant risk to DNS server operations. It is crucial to update to the patched version 9.14.12-r0 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for bind →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of BIND prior to 9.14.12-r0 are affected by this vulnerability.
If exploited, this vulnerability can lead to an inconsistent state in the BIND server, which may result in DNS resolution failures or other harmful effects.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
