cbcvebase.
CVE-2020-8625
published 2021-02-17

CVE-2020-8625: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default…

PriorityP270high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
64.16%
99.1th percentile
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
debianbind9< bind9 1:9.16.12-1 (bookworm)bind9 1:9.16.12-1 (bookworm)
debiandebian_linux
debiandebian_linux
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind
iscbind9.12.0 – 9.16.11
iscbind9.5.0 – 9.11.27
iscbind9
iscbind9
iscbind9
iscbind9
iscbind9
iscbind9>= 0 < 1:9.16.12-11:9.16.12-1

Detection & IOCsextracted from sources · hover to see the quote

pathlib/dns/spnego.c
  • Vulnerability is only triggerable when BIND is explicitly configured with tkey-gssapi-keytab or tkey-gssapi-credential options; scan named.conf for these directives to identify exposed instances.
  • The vulnerable code path is in der_get_oid() within the SPNEGO component (lib/dns/spnego.c); monitor for crashes of the named process originating from this call stack as an exploitation indicator.
  • Exploitation is triggered via a crafted TKEY/GSS-TSIG request sent remotely and without authentication; monitor DNS traffic for anomalous TKEY queries targeting GSS-TSIG-enabled servers.
  • The exploit abuses the decode_MechTypeList() loop calling der_get_oid() repeatedly with a controllable loop count; anomalous SPNEGO NegTokenInit messages with many MechType OIDs in a TKEY request are a strong exploitation signal.
  • On glibc 2.27+ (tcache-enabled) systems, exploitation involves a tcache dup/poison attack; a heap pointer leak may be sent back to the client via the SPNEGO NegTokenArg response buffer — monitor for unexpected data in TKEY responses.
  • Ubuntu deployments may be partially mitigated by the Bind AppArmor profile even if exploitation succeeds; verify AppArmor enforcement status on BIND installations.
  • ·Default BIND configurations are NOT vulnerable; the exploit path is only exposed when tkey-gssapi-keytab or tkey-gssapi-credential is explicitly set in named.conf.
  • ·GSS-TSIG is commonly enabled in BIND+Samba integrations and mixed BIND/Active Directory environments, making those deployments the primary at-risk population.
  • ·Red Hat ships BIND compiled with GSS-TSIG support (affected binary) but default package settings do not enable the vulnerable options, so RHEL systems are affected only if GSS-TSIG options are explicitly configured.
  • ·Exploit reliability is highly dependent on glibc version; the tcache-based exploitation path was demonstrated on Ubuntu 18.04 with glibc 2.27.
  • ·Full RCE has not been demonstrated end-to-end; the most likely outcome of exploitation is a crash of the named process.

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.