Critical Vulnerability in BIND Package: CVE-2020-8623 - Potential Crash Triggered by Malicious Queries
Summary
ALPINE-CVE-2020-8623: In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query p... Affects bind versions < 9.16.6-r0. Fixed in 9.16.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides name resolution services for various applications and systems. It is known for its robustness and flexibility, supporting features like DNSSEC, dynamic updates, and zone transfers. However, certain configurations can expose BIND to vulnerabilities, such as CVE-2020-8623, which can lead to system crashes when exploited.
Vulnerability Detail
CVE-2020-8623 is a vulnerability in BIND versions 9.10.0 to 9.11.21, 9.12.0 to 9.16.5, and 9.17.0 to 9.17.3. An attacker capable of sending specially crafted query packets to a vulnerable BIND server can trigger a crash. The conditions for exploitation include the server being built with the '--enable-native-pkcs11' option and signing zones with an RSA key. This vulnerability poses a significant risk as it can lead to denial of service, impacting the availability of DNS services.
How To Fix
Minimum fixed version
9.16.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of RSA keys for zone signing or avoid using the '--enable-native-pkcs11' option when building BIND. However, these measures may limit the functionality of your DNS server.
Conclusion
CVE-2020-8623 is a critical vulnerability in the BIND DNS server that can lead to system crashes if exploited. It is essential to update to the patched version to mitigate risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for bind →
FAQ
CVE-2020-8623 is a vulnerability in the BIND DNS server that allows an attacker to crash the server by sending specially crafted query packets.
Affected versions include BIND 9.10.0 to 9.11.21, 9.12.0 to 9.16.5, and 9.17.0 to 9.17.3.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2020-8623 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing workarounds such as disabling RSA key signing or avoiding the '--enable-native-pkcs11' option.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
