Security Bulletin: Vulnerabilities in BIND affect Power Hardware Management Console (CVE-2020-8622, CVE-2020-8623 and CVE-2020-8624)

2021-09-2223:38:15

www.ibm.com

0.022 Low

EPSS

Percentile

89.6%

JSON

Summary

BIND is used by Power Hardware Management Console (HMC). HMC has addressed the applicable CVE’s.

Vulnerability Details

CVEID:CVE-2020-8622
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an assertion failure when attempting to verify a truncated response to a TSIG-signed request. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause the server to exit.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187060 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-8623
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an assertion failure when built with “–enable-native-pkcs11”. By sending a specially-crafted packet, a remote attacker could exploit this vulnerability to cause the server to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187061 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-8624
**DESCRIPTION:**ISC BIND could allow a remote authenticated attacker to bypass security restrictions, caused by the failure to properly enforce the update-policy rules of type “subdomain”. By sending a specially-crafted request, an attacker could exploit this vulnerability to update other contents of the zone.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187062 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)