CVE-2020-8625
published 2021-02-17CVE-2020-8625: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default…
PriorityP270high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
64.16%
99.1th percentile
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bind9 | < bind9 1:9.16.12-1 (bookworm) | bind9 1:9.16.12-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | 9.12.0 – 9.16.11 | — |
| isc | bind | 9.5.0 – 9.11.27 | — |
| isc | bind9 | — | — |
| isc | bind9 | — | — |
| isc | bind9 | — | — |
| isc | bind9 | — | — |
| isc | bind9 | — | — |
| isc | bind9 | >= 0 < 1:9.16.12-1 | 1:9.16.12-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is only triggerable when BIND is explicitly configured with tkey-gssapi-keytab or tkey-gssapi-credential options; scan named.conf for these directives to identify exposed instances. ↗
- →The vulnerable code path is in der_get_oid() within the SPNEGO component (lib/dns/spnego.c); monitor for crashes of the named process originating from this call stack as an exploitation indicator. ↗
- →Exploitation is triggered via a crafted TKEY/GSS-TSIG request sent remotely and without authentication; monitor DNS traffic for anomalous TKEY queries targeting GSS-TSIG-enabled servers. ↗
- →The exploit abuses the decode_MechTypeList() loop calling der_get_oid() repeatedly with a controllable loop count; anomalous SPNEGO NegTokenInit messages with many MechType OIDs in a TKEY request are a strong exploitation signal. ↗
- →On glibc 2.27+ (tcache-enabled) systems, exploitation involves a tcache dup/poison attack; a heap pointer leak may be sent back to the client via the SPNEGO NegTokenArg response buffer — monitor for unexpected data in TKEY responses. ↗
- →Ubuntu deployments may be partially mitigated by the Bind AppArmor profile even if exploitation succeeds; verify AppArmor enforcement status on BIND installations. ↗
- ·Default BIND configurations are NOT vulnerable; the exploit path is only exposed when tkey-gssapi-keytab or tkey-gssapi-credential is explicitly set in named.conf. ↗
- ·GSS-TSIG is commonly enabled in BIND+Samba integrations and mixed BIND/Active Directory environments, making those deployments the primary at-risk population. ↗
- ·Red Hat ships BIND compiled with GSS-TSIG support (affected binary) but default package settings do not enable the vulnerable options, so RHEL systems are affected only if GSS-TSIG options are explicitly configured. ↗
- ·Exploit reliability is highly dependent on glibc version; the tcache-based exploitation path was demonstrated on Ubuntu 18.04 with glibc 2.27. ↗
- ·Full RCE has not been demonstrated end-to-end; the most likely outcome of exploitation is a crash of the named process. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Ubuntu
Bind vulnerability
vendor_ubuntu·2021-03-01
CVE-2020-8625 Bind vulnerability
Title: Bind vulnerability
Summary: Bind could be made to crash or run programs if it received specially
crafted network traffic.
USN-4737-1 fixed a vulnerability in Bind. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Bind incorrectly handled GSSAPI security policy
negotiation. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly execute arbitrary code. In
the default installation, attackers would be isolated by the Bind AppArmor
profile.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Bind vulnerability
vendor_ubuntu·2021-02-18
CVE-2020-8625 Bind vulnerability
Title: Bind vulnerability
Summary: Bind could be made to crash or run programs if it received specially
crafted network traffic.
It was discovered that Bind incorrectly handled GSSAPI security policy
negotiation. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly execute arbitrary code. In
the default installation, attackers would be isolated by the Bind AppArmor
profile.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation
vendor_redhat·2021-02-17·CVSS 8.1
CVE-2020-8625 [HIGH] CWE-119 bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation
bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process.
Microsoft
A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
vendor_msrc·2021-02-09·CVSS 8.1
CVE-2020-8625 [HIGH] CWE-120 A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
isc: isc
Customer Action Required: Yes
Remediation: C
Debian
CVE-2020-8625: bind9 - BIND servers are vulnerable if they are running an affected version and are conf...
vendor_debian·2020·CVSS 8.1
CVE-2020-8625 [HIGH] CVE-2020-8625: bind9 - BIND servers are vulnerable if they are running an affected version and are conf...
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -
GHSA
GHSA-mxh3-93ph-p9r2: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features
ghsa_unreviewed·2022-05-24
CVE-2020-8625 [HIGH] CWE-120 GHSA-mxh3-93ph-p9r2: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -
OSV
CVE-2020-8625: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features
osv·2021-02-17·CVSS 8.1
CVE-2020-8625 [HIGH] CVE-2020-8625: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -
No detection rules found.
No public exploits indexed.
Trendmicro
RCE Bug Returns in ISC BIND Server
blogs_trendmicro·2021-02-25·CVSS 5.0
CVE-2020-8625 [MEDIUM] RCE Bug Returns in ISC BIND Server
# CVE-2020-8625: A Fifteen-Year-Old RCE Bug Returns in ISC BIND Server
Learn how a a fifteen-year-old RCE bug returns in ISC BIND server.
By: Zero Day Initiative
2021/02/25
Read time: ( words)
Save to Folio
In October 2020, we received a submission from an anonymous researcher targeting the ISC BIND server. The discovery was based upon an earlier vulnerability, CVE-2006-5989, which affected the Apache module mod_auth_kerb and was initially found by an anonymous researcher. The ISC BIND server shared the vulnerable code within the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) component, but ISC did not merge the patch at that time. After 15 years, ISC patched the bug in BIND and assigned it CVE-2020-8625.
This vulnerability affects BIND versions from 9.11 to 9.16. It can
Trendmicro
RCE Bug Returns in ISC BIND Server
blogs_trendmicro·2021-02-25·CVSS 5.0
CVE-2020-8625 [MEDIUM] RCE Bug Returns in ISC BIND Server
## CVE-2020-8625: A Fifteen-Year-Old RCE Bug Returns in ISC BIND Server
Learn how a a fifteen-year-old RCE bug returns in ISC BIND server.
By: Zero Day Initiative Feb 25, 2021 Read time: ( words)
Save to Folio
In October 2020, we received a submission from an anonymous researcher targeting the ISC BIND server. The discovery was based upon an earlier vulnerability, CVE-2006-5989 , which affected the Apache module mod_auth_kerb and was initially found by an anonymous researcher. The ISC BIND server shared the vulnerable code within the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) component, but ISC did not merge the patch at that time. After 15 years, ISC patched the bug in BIND and assigned it CVE-2020-8625 .
This vulnerability affects BIND versions from 9.11 to 9.16. It
Trendmicro
RCE Bug Returns in ISC BIND Server
blogs_trendmicro·2021-02-25·CVSS 5.0
CVE-2020-8625 [MEDIUM] RCE Bug Returns in ISC BIND Server
## CVE-2020-8625: A Fifteen-Year-Old RCE Bug Returns in ISC BIND Server
Learn how a a fifteen-year-old RCE bug returns in ISC BIND server.
By: Zero Day Initiative 2021/02/25 Read time: ( words)
Save to Folio
In October 2020, we received a submission from an anonymous researcher targeting the ISC BIND server. The discovery was based upon an earlier vulnerability, CVE-2006-5989 , which affected the Apache module mod_auth_kerb and was initially found by an anonymous researcher. The ISC BIND server shared the vulnerable code within the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) component, but ISC did not merge the patch at that time. After 15 years, ISC patched the bug in BIND and assigned it CVE-2020-8625 .
This vulnerability affects BIND versions from 9.11 to 9.16. It ca
arXiv
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
arxiv_fulltext·2023-10-04
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
https://faculty.sites.uci.edu/zhouli/research/ Qifan Zhang ,
https://faculty.sites.uci.edu/zhouli/research/ Xuesong Bai ,
https://netsec.ccert.edu.cn/people/lx19 Xiang Li ,
https://netsec.ccert.edu.cn/people/duanhx/ Haixin Duan ,
https://netsec.ccert.edu.cn/people/qli/ Qi Li , and
https://faculty.sites.uci.edu/zhouli/ Zhou Li
Corresponding authors. Most of Xiang Li's work was done when visiting UCI as a project specialist.
https://uci.edu/University of California, Irvine,
https://www.tsinghua.edu.cn/en/Tsinghua University
Zhongguancun Laboratory,
https://www.qcl.edu.cn/Quan Cheng Laboratory
## Abstract
Domain Name System (DNS) is a critical component of the Internet. DNS resolvers, which act as the cache
Bugzilla
CVE-2019-8625 webkitgtk: Incorrect state management leading to universal cross-site scripting
bugzilla·2020-09-07·CVSS 6.1
CVE-2019-8625 [MEDIUM] CVE-2019-8625 webkitgtk: Incorrect state management leading to universal cross-site scripting
CVE-2019-8625 webkitgtk: Incorrect state management leading to universal cross-site scripting
WebKitGTK Security Advisory WSA-2019-0005 describes the following issue:
CVE-2019-8625
Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.
Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.
Discussion:
External References:
https://webkitgtk.org/security/WSA-2019-0005.html
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:4035 https://access.redhat.com/errata/RHSA-2020:4035
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redha
http://www.openwall.com/lists/oss-security/2021/02/19/1http://www.openwall.com/lists/oss-security/2021/02/20/2https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://kb.isc.org/v1/docs/cve-2020-8625https://lists.debian.org/debian-lts-announce/2021/02/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBTPWRQWRQEJNWY4NHO4WLS4KLJ3ERHZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYXAF7G45RXDVNUTWWCI2CVTHRZ67LST/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWCMBOSZOJIIET7BWTRYS3HLX5TSDKHX/https://security.netapp.com/advisory/ntap-20210319-0001/https://www.debian.org/security/2021/dsa-4857https://www.zerodayinitiative.com/advisories/ZDI-21-195/http://www.openwall.com/lists/oss-security/2021/02/19/1http://www.openwall.com/lists/oss-security/2021/02/20/2https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://kb.isc.org/v1/docs/cve-2020-8625https://lists.debian.org/debian-lts-announce/2021/02/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBTPWRQWRQEJNWY4NHO4WLS4KLJ3ERHZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYXAF7G45RXDVNUTWWCI2CVTHRZ67LST/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWCMBOSZOJIIET7BWTRYS3HLX5TSDKHX/https://security.netapp.com/advisory/ntap-20210319-0001/https://www.debian.org/security/2021/dsa-4857https://www.zerodayinitiative.com/advisories/ZDI-21-195/
2021-02-17
Published