ArchLinux: 202005-13: bind: denial of service
Summary
- CVE-2020-8616 (denial of service)
An issue has been found in bind before 9.16.3, which does not
sufficiently limit the number of fetches which may be performed while
processing a referral response. A malicious actor who intentionally
exploits this lack of effective limitation on the number of fetches
performed when processing referrals can, through the use of specially
crafted referrals, cause a recursing server to issue a very large
number of fetches in an attempt to process the referral. This has at
least two potential effects: the performance of the recursing server
can potentially be degraded by the additional work required to perform
these fetches, and the attacker can exploit this behavior to use the
recursing server as a reflector in a reflection attack with a high
amplification factor.
- CVE-2020-8617 (denial of service)
An error in bind before 9.16.3 in the code which checks the validity of
messages containing TSIG resource records can be exploited by an
attacker to trigger an assertion failure in tsig.c, resulting in denial
of service to clients.
Resolution
Upgrade to 9.16.3-1.
# pacman -Syu "bind>=9.16.3-1"
The problems have been fixed upstream in version 9.16.3.
References
https://kb.isc.org/docs/cve-2020-8616 https://kb.isc.org/docs/cve-2020-8617 https://kb.isc.org/docs/cve-2020-8617-faq-and-supplemental-information https://www.nxnsattack.com/ https://security.archlinux.org/CVE-2020-8616 https://security.archlinux.org/CVE-2020-8617
Workaround
None.
