CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• debian debian linux9.0
• fedoraproject fedora32
• fedoraproject fedora33
• fedoraproject fedora34
• isc bind9.5.0 and later · up to 9.11.27 inclusive
• isc bind9.12.0 and later · up to 9.16.11 inclusive
• isc bind9.11.21
• isc bind9.11.27
• isc bind9.11.3
• isc bind9.11.5
• isc bind9.11.6
• isc bind9.11.7
• isc bind9.11.8
• isc bind9.16.11
• isc bind9.16.8
• isc bind9.17.0
• isc bind9.17.1
• netapp 500f firmwareall versions
• netapp a250 firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (isc). Independent of NVD's CPE analysis and usually ahead of it.

• ISC BIND9

  • Open Source Branches 9.5 though 9.11 9.5.0 through versions before 9.11.28, Open Source Branches 9.12 though 9.16 9.12.0 through versions before 9.16.12, Supported Preview Branch 9.11-S 9.11.3-S1 through versions before 9.11.28-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.12-S1, Development Branch 9.17 9.17.0 through versions before 9.17.2affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion faKEV
  90Now
• CVE-2020-8617A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
  60This week
• CVE-2016-2776buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses,
  60This week

Published before and after this one in the same product

• ← EarlierCVE-2020-8623Aug 21, 2020 · A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c
  32Monitor
• ← EarlierCVE-2020-8624Aug 21, 2020 · update-policy rules of type "subdomain" are enforced incorrectly
  18Monitor
• Later →CVE-2021-25214Apr 28, 2021 · A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
  28Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.