CVE-2020-8625

NameCVE-2020-8625
DescriptionBIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2568-1, DSA-4857-1
NVD severitymedium
Debian Bugs983004

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)stretch1:9.10.3.dfsg.P4-12.3+deb9u6vulnerable
stretch (security)1:9.10.3.dfsg.P4-12.3+deb9u9fixed
buster, buster (security)1:9.11.5.P4+dfsg-5.1+deb10u5fixed
bullseye, sid1:9.16.15-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bind9sourcestretch1:9.10.3.dfsg.P4-12.3+deb9u8DLA-2568-1
bind9sourcebuster1:9.11.5.P4+dfsg-5.1+deb10u3DSA-4857-1
bind9source(unstable)1:9.16.12-1983004

Notes

https://kb.isc.org/v1/docs/cve-2020-8625
9.11 branch: https://downloads.isc.org/isc/bind9/9.11.28/patches
9.16 branch: https://downloads.isc.org/isc/bind9/9.16.12/patches
https://gitlab.isc.org/isc-projects/bind9/commit/b04cb88462863d762093760ffcfe1946200e30f5

Search for package or bug name: Reporting problems