CVE-2020-8622
Description
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
How to fix
- synology dns_server2.2.2-5028 or later
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/
- usn.ubuntu.com/4468-1/
- usn.ubuntu.com/4468-2/
- debian.org/security/2020/dsa-4752
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/
- security.gentoo.org/glsa/202008-19
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isc bind | 9.0.0 ≤ v ≤ 9.11.21, 9.12.0 ≤ v ≤ 9.16.5, 9.17.0 ≤ v ≤ 9.17.3, 9.9.3, 9.11.21 | — |
| fedoraproject fedora | 31, 32 | — |
| debian debian_linux | 9.0, 10.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04, 20.04 | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| opensuse leap | 15.1, 15.2 | — |
| synology dns_server | v < 2.2.2-5028 | 2.2.2-5028 |
| oracle communications_diameter_signaling_router | 8.0.0 ≤ v ≤ 8.5.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.