CVE-2020-8625

Description

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

How to fix CVE-2020-8625

To remediate CVE-2020-8625, upgrade the affected package to a fixed version below.

• —upgrade to 9.16.11-r2 or later
• —upgrade to 1:9.16.12-1 or later
• —upgrade to 1:9.10.3.dfsg.P4-12.3+deb9u8 or later
• —upgrade to 1:9.11.5.P4+dfsg-5.1+deb10u3 or later

Is CVE-2020-8625 being exploited?

Moderate — EPSS is 25.1%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

• from 0, < 9.16.11-r2
• from 0, < 1:9.16.12-1
• from 0, < 1:9.10.3.dfsg.P4-12.3+deb9u8
• from 0, < 1:9.11.5.P4+dfsg-5.1+deb10u3

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2020-8625
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-8625