CVE-2020-8617

Description from NVD

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.

NVD References

Description from Forti

ISC BIND TSIG Assertion Failure DoS

This indicates an attack attempt to exploit a Denial Of Service Vulnerability in ISC BIND.The vulnerability is due to a fault in the DNS protocol when handling a crafted packet. A remote attacker may be able to exploit this to cause a denial of service condition on the affected system.

Affected Products

ISC BIND 9.0.0 - 9.11.18
ISC BIND 9.12.0 - 9.12.4-P2
ISC BIND 9.14.0 - 9.14.11
ISC BIND 9.16.0 - 9.16.2
ISC BIND 9.17.0 - 9.17.1 of the 9.17 experimental development branch
All releases in the obsolete 9.13 and 9.15 development branches.
All releases of BIND Supported Preview Edition from 9.9.3-S1 to 9.11.18-S1

Impact

Denial of Service: Remote attackers can crash vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor:
https://kb.isc.org/docs/cve-2020-8617

References

Refer to Information on External Sites

Software Tag: BIND(4 tweets) Linux(2 tweets)