Vulnerability Report

CVE-2020-8622

Title: Isc Bind

Other

Proof Of Concept

No public PoC currently indexed for CVE-2020-8622.

CWE Category CWE-617
Published Date Aug 21, 2020
Modified Date Nov 21, 2024
Exploit Status Not Found
Score 6.5 CVSS v3.1
Exploit Probability (EPSS)
2.63%

Vulnerability Summary

CVE-2020-8622: In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Impacted Vendors

I
isc 1
N
netapp 1
O
oracle 1
S
synology 1

Reference Links

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html https://kb.isc.org/docs/cve-2020-8622 https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/ https://security.gentoo.org/glsa/202008-19 https://security.netapp.com/advisory/ntap-20200827-0003/ https://usn.ubuntu.com/4468-1/ https://usn.ubuntu.com/4468-2/ https://www.debian.org/security/2020/dsa-4752 https://www.oracle.com/security-alerts/cpuoct2021.html https://www.synology.com/security/advisory/Synology_SA_20_19 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html https://kb.isc.org/docs/cve-2020-8622 https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/ https://security.gentoo.org/glsa/202008-19 https://security.netapp.com/advisory/ntap-20200827-0003/ https://usn.ubuntu.com/4468-1/ https://usn.ubuntu.com/4468-2/ https://www.debian.org/security/2020/dsa-4752 https://www.oracle.com/security-alerts/cpuoct2021.html https://www.synology.com/security/advisory/Synology_SA_20_19
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.5
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.5
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
4.0
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:S/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2020-8622 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Stack

No specific products linked.