Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2020-8616 CVE-2020-8617

An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This flaw allows an attacker that knows or successfully guesses the name of the TSIG key used by the server to use a specially-crafted message, potentially causing a BIND server to reach an inconsistent state or cause a denial of service. A majority of BIND servers have an internally-generated TSIG session key whose name is trivially guessable, and that key exposes the vulnerability unless specifically disabled. (CVE-2020-8617) A flaw was found in BIND, where it does not sufficiently limit the number of fetches that can be performed while processing a referral response. This flaw allows an attacker to cause a denial of service attack. The attacker can also exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

Source

ALAS2-2020-1426

Amazon Linux 2 Security Advisory: ALAS-2020-1426
Advisory Release Date: 2020-05-19 18:32 Pacific
Advisory Updated Date: 2020-05-20 20:14 Pacific

Severity: Important

References: CVE-2020-8616 CVE-2020-8617

Issue Overview:

An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This flaw allows an attacker that knows or successfully guesses the name of the TSIG key used by the server to use a specially-crafted message, potentially causing a BIND server to reach an inconsistent state or cause a denial of service. A majority of BIND servers have an internally-generated TSIG session key whose name is trivially guessable, and that key exposes the vulnerability unless specifically disabled. (CVE-2020-8617)

A flaw was found in BIND, where it does not sufficiently limit the number of fetches that can be performed while processing a referral response. This flaw allows an attacker to cause a denial of service attack. The attacker can also exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

Affected Packages:

bind

Issue Correction:
Run yum update bind to update your system.

New Packages:

aarch64:
    bind-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-pkcs11-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-pkcs11-utils-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-pkcs11-libs-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-pkcs11-devel-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-sdb-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-libs-lite-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-libs-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-utils-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-devel-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-lite-devel-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-chroot-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-sdb-chroot-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-export-libs-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-export-devel-9.11.4-9.P2.amzn2.0.3.aarch64
    bind-debuginfo-9.11.4-9.P2.amzn2.0.3.aarch64

i686:
    bind-9.11.4-9.P2.amzn2.0.3.i686
    bind-pkcs11-9.11.4-9.P2.amzn2.0.3.i686
    bind-pkcs11-utils-9.11.4-9.P2.amzn2.0.3.i686
    bind-pkcs11-libs-9.11.4-9.P2.amzn2.0.3.i686
    bind-pkcs11-devel-9.11.4-9.P2.amzn2.0.3.i686
    bind-sdb-9.11.4-9.P2.amzn2.0.3.i686
    bind-libs-lite-9.11.4-9.P2.amzn2.0.3.i686
    bind-libs-9.11.4-9.P2.amzn2.0.3.i686
    bind-utils-9.11.4-9.P2.amzn2.0.3.i686
    bind-devel-9.11.4-9.P2.amzn2.0.3.i686
    bind-lite-devel-9.11.4-9.P2.amzn2.0.3.i686
    bind-chroot-9.11.4-9.P2.amzn2.0.3.i686
    bind-sdb-chroot-9.11.4-9.P2.amzn2.0.3.i686
    bind-export-libs-9.11.4-9.P2.amzn2.0.3.i686
    bind-export-devel-9.11.4-9.P2.amzn2.0.3.i686
    bind-debuginfo-9.11.4-9.P2.amzn2.0.3.i686

noarch:
    bind-license-9.11.4-9.P2.amzn2.0.3.noarch

src:
    bind-9.11.4-9.P2.amzn2.0.3.src

x86_64:
    bind-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-pkcs11-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-pkcs11-utils-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-pkcs11-libs-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-pkcs11-devel-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-sdb-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-libs-lite-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-libs-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-utils-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-devel-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-lite-devel-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-chroot-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-sdb-chroot-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-export-libs-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-export-devel-9.11.4-9.P2.amzn2.0.3.x86_64
    bind-debuginfo-9.11.4-9.P2.amzn2.0.3.x86_64

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS2-2020-1426

ALAS2-2020-1426

Vulmon Search

About

Products

Connect