CVE-2020-8617 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

🗓️ 19 May 2020 14:05:16Reported by iscType

A logic error allows attacker to trigger assertion failure in BIND serve

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: Vulnerability in bind affects IBM Integrated Analytics System	10 Nov 202011:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect V10 is impacted by denial of service vulnerabilities in Crunchy kernel (CVE-2020-8616, CVE-2020-8617)	7 Oct 202023:02	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Publicly disclosed vulnerabilities from Bind affect IBM Netezza Host Management	10 Aug 202010:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in BIND affect AIX (CVE-2020-8616 and CVE-2020-8617)	21 Aug 202021:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in bind (CVE-2020-8616 and CVE-2020-8617).	22 Sep 202123:38	–	ibm
IBM Security Bulletins	Security Bulletin: BIND for IBM i is affected by CVE-2020-8616 and CVE-2020-8617	6 Jul 202022:37	–	ibm
0day.today	BIND - (TSIG) Denial of Service Exploit	27 May 202000:00	–	zdt
ALT Linux	Security fix for the ALT Linux 10 package bind version 9.11.19-alt1	19 May 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package bind version 9.10.8.P1-alt2	26 May 202000:00	–	altlinux

[
  {
    "product": "BIND9",
    "vendor": "ISC",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/
usn	www.usn.ubuntu.com/4365-2/
packetstormsecurity	www.packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html
kb	www.kb.isc.org/docs/cve-2020-8617
security	www.security.netapp.com/advisory/ntap-20200522-0002/
openwall	www.openwall.com/lists/oss-security/2020/05/19/4
lists	www.lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
usn	www.usn.ubuntu.com/4365-1/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/

20 Oct 2020 11:06Current

8High risk

Vulners AI Score8

CVSS 3.17.5

EPSS0.93422