Privilege Escalation Vulnerability in BIND Package: CVE-2020-8624
Summary
ALPINE-CVE-2020-8624: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has... Affects bind versions < 9.16.6-r0. Fixed in 9.16.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that facilitates the resolution of domain names into IP addresses. It is known for its robustness and flexibility, making it a popular choice for managing DNS services. However, BIND has been found to have a vulnerability (CVE-2020-8624) that allows an attacker with specific privileges to exploit unintended additional privileges, potentially leading to unauthorized updates of DNS zone content.
Vulnerability Detail
The vulnerability arises from improper handling of privileges within BIND versions 9.9.12 to 9.16.5. An attacker who has been granted limited privileges to modify a specific subset of a zone's content can exploit this flaw to update other contents of the zone without authorization. This could lead to significant security risks, including the potential for DNS spoofing or other malicious activities that compromise the integrity of the DNS records.
How To Fix
Minimum fixed version
9.16.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting the privileges granted to users who can modify DNS zone content until the package can be updated. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
CVE-2020-8624 represents a significant security risk for users of the BIND DNS server software. By understanding the nature of the vulnerability and taking appropriate steps to update the software or implement workarounds, users can protect their systems from potential exploitation.
See every vulnerability recorded for bind →
FAQ
CVE-2020-8624 is a vulnerability in the BIND DNS server software that allows an attacker with limited privileges to exploit additional privileges, potentially leading to unauthorized updates of DNS records.
The vulnerability affects BIND versions 9.9.12 to 9.16.5, including various supported preview editions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for CVE-2020-8624 is 4.3, indicating a moderate level of severity.
If an immediate update is not possible, consider limiting user privileges for modifying DNS zone content as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
