CVE-2020-8616

BIND does not sufficiently limit the number of fetches performed when processing referrals

HIGH 8.6

En bref

Source: NVD
EPSS: EPSS 10.88 % · centile 96 (2026-10-28)
État: PUBLISHED
Publiée: 2020-05-19 14:05 UTC
Mise à jour: 2024-09-16 23:55 UTC
Attribuée par: isc
Statut NVD: Modified

Description

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

Faiblesses (CWE)

CWE-400 — Consommation de ressources non maîtrisée (déni de service)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	isc
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	NVD · security-officer@isc.org (Secondary)
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2020-29464
GCVE · GCVE-0-2020-8616

Avis du CERT-FR

CERTFR-2022-AVI-650 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2021-AVI-033 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2020-AVI-302 — Multiples vulnérabilités dans Bind · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.0.0 ≤ 9.11.18
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.12.0 ≤ 9.12.4
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.13.0 ≤ 9.13.7
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.14.0 ≤ 9.14.11
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.15.0 ≤ 9.15.6
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.16.0 ≤ 9.16.2
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.17.0 ≤ 9.17.1
cpe:2.3:a:isc:bind:9.12.4:p1:*:*:*:*:*:*
cpe:2.3:a:isc:bind:9.12.4:p2:*:*:*:*:*:*
cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
ISC · BIND9	affected 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD