CVE-2020-8625: ISC BIND TKEY Query Heap-based Buffer Overflow Remote Code Execution Vulnerability
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
Other sources
ISC BIND is vulnerable to a buffer overflow, caused by improper bounds checking by the SPNEGO implementation. By setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the named process to crash.
— IBM
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ISC BIND. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of TKEY queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the "bind" user.
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2020-8625?
CVE-2020-8625 is a vulnerability in ISC BIND that allows for remote code execution due to a heap-based buffer overflow in TKEY query processing.
Which servers are vulnerable to CVE-2020-8625?
BIND servers running affected versions and configured to use GSS-TSIG features are vulnerable.
How severe is CVE-2020-8625?
CVE-2020-8625 has a severity rating of 8.1 (High).
How can I fix CVE-2020-8625?
To fix CVE-2020-8625, update to a patched version of ISC BIND or apply the recommended security updates for your specific software or platform.
Where can I find more information about CVE-2020-8625?
You can find more information about CVE-2020-8625 in the references provided: [reference 1](http://www.openwall.com/lists/oss-security/2021/02/19/1), [reference 2](http://www.openwall.com/lists/oss-security/2021/02/20/2), [reference 3](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf).