Vulnerabilities > CVE-2020-8625 - Classic Buffer Overflow vulnerability in multiple products

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Vulnerable Configurations

Part	Description	Count
Application	Isc ISC Bind 9.11.7 ISC Bind 9.11.3 ISC Bind 9.11.6 ISC Bind 9.11.5 ISC Bind 9.11.8 ISC Bind 9.11.21 ISC Bind 9.17.0 ISC Bind 9.17.1 ISC Bind 9.16.8 ISC Bind 9.16.11 ISC Bind 9.11.27 ISC Bind 9.12.0 ISC Bind 9.12.1 ISC Bind 9.12.2 ISC Bind 9.12.3 ISC Bind 9.12.4 ISC Bind 9.13.0 ISC Bind 9.13.1 ISC Bind 9.13.2 ISC Bind 9.13.3 ISC Bind 9.13.4 ISC Bind 9.13.5 ISC Bind 9.13.6 ISC Bind 9.13.7 ISC Bind 9.14.0 ISC Bind 9.14.1 ISC Bind 9.14.2 ISC Bind 9.14.3 ISC Bind 9.14.4 ISC Bind 9.14.5 ISC Bind 9.14.6 ISC Bind 9.14.7 ISC Bind 9.14.8 ISC Bind 9.14.9 ISC Bind 9.14.11 ISC Bind 9.14.12 ISC Bind 9.15.0 ISC Bind 9.15.1 ISC Bind 9.15.2 ISC Bind 9.15.3 ISC Bind 9.15.4 ISC Bind 9.15.5 ISC Bind 9.15.6 ISC Bind 9.16.0 ISC Bind 9.16.1 ISC Bind 9.16.2 ISC Bind 9.16.3 ISC Bind 9.16.4 ISC Bind 9.16.5 ISC Bind 9.16.6 ISC Bind 9.16.7 ISC Bind 9.16.9 ISC Bind 9.16.10 ISC Bind 9.5.0 ISC Bind 9.5.0-P1 ISC Bind 9.5.0-P2 ISC Bind 9.5.0-P2-W1 ISC Bind 9.5.0-P2-W2 ISC Bind 9.5.0A1 ISC Bind 9.5.0A2 ISC Bind 9.5.0A3 ISC Bind 9.5.0A4 ISC Bind 9.5.0A5 ISC Bind 9.5.0A6 ISC Bind 9.5.0A7 ISC Bind 9.5.0B1 ISC Bind 9.5.0B2 ISC Bind 9.5.0B3 ISC Bind 9.5.1 ISC Bind 9.5.1B1 ISC Bind 9.5.1B2 ISC Bind 9.5.1B3 ISC Bind 9.5.2 ISC Bind 9.5.2-P1 ISC Bind 9.5.2-P2 ISC Bind 9.5.2-P3 ISC Bind 9.5.2-P4 ISC Bind 9.5.2B1 ISC Bind 9.5.3 ISC Bind 9.5.3B1 ISC Bind 9.6 ISC Bind 9.6-Esv ISC Bind 9.6-Esv-R1 ISC Bind 9.6-Esv-R2 ISC Bind 9.6-Esv-R3 ISC Bind 9.6-Esv-R4 ISC Bind 9.6-Esv-R4-P1 ISC Bind 9.6-Esv-R5 ISC Bind 9.6-Esv-R5B1 ISC Bind 9.6-Esv-R6 ISC Bind 9.6-Esv-R7 ISC Bind 9.6-Esv-R9 ISC Bind 9.6.0 ISC Bind 9.6.0A1 ISC Bind 9.6.0B1 ISC Bind 9.6.1 ISC Bind 9.6.1B1 ISC Bind 9.6.2 ISC Bind 9.6.2-P1 ISC Bind 9.6.2-P2 ISC Bind 9.6.2-P3 ISC Bind 9.6.2B1 ISC Bind 9.6.3 ISC Bind 9.6.3B1 ISC Bind 9.7.0 ISC Bind 9.7.0A1 ISC Bind 9.7.0A2 ISC Bind 9.7.0A3 ISC Bind 9.7.0B1 ISC Bind 9.7.0B2 ISC Bind 9.7.0B3 ISC Bind 9.7.1 ISC Bind 9.7.1B1 ISC Bind 9.7.2 ISC Bind 9.7.3 ISC Bind 9.7.4 ISC Bind 9.7.4B1 ISC Bind 9.7.5 ISC Bind 9.7.6 ISC Bind 9.7.7 ISC Bind 9.8.0 ISC Bind 9.8.1 ISC Bind 9.8.2 ISC Bind 9.8.3 ISC Bind 9.8.4 ISC Bind 9.8.5 ISC Bind 9.8.6 ISC Bind 9.8.7 ISC Bind 9.8.8 ISC Bind 9.8.9 ISC Bind 9.9.0 ISC Bind 9.9.1 ISC Bind 9.9.2 ISC Bind 9.9.3 ISC Bind 9.9.4 ISC Bind 9.9.4-65 ISC Bind 9.9.4-72 ISC Bind 9.9.5 ISC Bind 9.9.6 ISC Bind 9.9.7 ISC Bind 9.9.8 ISC Bind 9.9.9 ISC Bind 9.9.10 ISC Bind 9.9.11 ISC Bind 9.9.12 ISC Bind 9.9.13 ISC Bind 9.10.0 ISC Bind 9.10.1 ISC Bind 9.10.2 ISC Bind 9.10.3 ISC Bind 9.10.4 ISC Bind 9.10.5 ISC Bind 9.10.6 ISC Bind 9.10.7 ISC Bind 9.10.8 ISC Bind 9.11.0 ISC Bind 9.11.1 ISC Bind 9.11.2 ISC Bind 9.11.4 ISC Bind 9.11.9 ISC Bind 9.11.10 ISC Bind 9.11.11 ISC Bind 9.11.12 ISC Bind 9.11.14 ISC Bind 9.11.14-S1 ISC Bind 9.11.18 ISC Bind 9.11.19 ISC Bind 9.11.19-S1 ISC Bind 9.11.20 ISC Bind 9.11.22 ISC Bind 9.11.23 ISC Bind 9.11.25 ISC Bind 9.11.26	894
Application	Siemens Siemens Sinec Infrastructure Network Services - Siemens Sinec Infrastructure Network Services 1.0.1	2
Application	Netapp Netapp Cloud Backup -	1
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2
OS	Fedoraproject Fedoraproject Fedora 32 Fedoraproject Fedora 33 Fedoraproject Fedora 34	3
OS	Netapp Netapp A250 Firmware - Netapp 500F Firmware -	2
Hardware	Netapp Netapp A250 - Netapp 500F -	2

Common Weakness Enumeration (CWE)

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
Client-side Injection-induced Buffer Overflow
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
Filter Failure through Buffer Overflow
In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
MIME Conversion
An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References