Critical Vulnerability in BIND Package: Server Crash Risk Due to QNAME Minimization
Summary
ALPINE-CVE-2020-8621: In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the... Affects bind versions < 9.16.6-r0. Fixed in 9.16.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides essential services for translating domain names into IP addresses. It is known for its flexibility, scalability, and support for various DNS features. However, certain configurations can expose BIND to vulnerabilities, such as the one identified in CVE-2020-8621, which affects versions 9.14.0 to 9.16.5 and 9.17.0 to 9.17.3.
Vulnerability Detail
The vulnerability arises when a BIND server is configured with both QNAME minimization and 'forward first' settings. An attacker capable of sending queries to the server may exploit this configuration to trigger a crash, leading to denial of service. This issue does not affect servers configured to 'forward only'. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.16.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider reconfiguring your BIND server to use 'forward only' instead of 'forward first'. This change will mitigate the risk of the server crashing due to the vulnerability.
Conclusion
The vulnerability identified as CVE-2020-8621 poses a significant risk to BIND servers configured with specific settings. It is crucial to update to the patched version or implement workarounds to ensure the stability and security of your DNS services.
See every vulnerability recorded for bind →
FAQ
CVE-2020-8621 is a vulnerability in BIND that can cause a server crash when configured with both QNAME minimization and 'forward first'.
You can check your BIND server version and configuration settings. If you are using versions 9.14.0 to 9.16.5 or 9.17.0 to 9.17.3 with the specified configuration, your server is vulnerable.
If an immediate update is not possible, reconfigure your server to use 'forward only' to mitigate the risk until you can apply the patch.
Exploiting this vulnerability can lead to a denial of service, causing your DNS server to crash and become unavailable to users.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
