CVE-2020-8618

Summary

An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.

Affected Software

Weaknesses

• An assertion check in BIND (that is meant to prevent going beyond the end of a buffer when processing incoming data) can be incorrectly triggered by a large response during zone transfer. Versions affected: BIND 9.16.0 -> 9.16.3

Workarounds

None

ADP Enrichment

CVE Program Container

Additional References

• https://kb.isc.org/docs/cve-2020-8618
• https://security.netapp.com/advisory/ntap-20200625-0003/
• https://usn.ubuntu.com/4399-1/
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html

References

• https://kb.isc.org/docs/cve-2020-8618
• https://security.netapp.com/advisory/ntap-20200625-0003/
• https://usn.ubuntu.com/4399-1/
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html

• ←Previous
• Next→