ISC BIND up to 9.17.3 Zone Update privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in ISC BIND up to 9.17.3. This issue affects some unknown processing of the component Zone Handler. The manipulation as part of Update leads to privileges management. This vulnerability is referenced as CVE-2020-8624. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ISC BIND up to 9.17.3 (Domain Name Software). This issue affects an unknown functionality of the component Zone Handler. The manipulation as part of a Update leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

The weakness was published 08/21/2020 (Website). It is possible to read the advisory at kb.isc.org. The identification of this vulnerability is CVE-2020-8624 since 02/05/2020. The attack may be initiated remotely. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 236577 (Alibaba Cloud Linux 3 : 0025: bind (ALINUX3-SA-2021:0025)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236577). Similar entries are available at VDB-160174, VDB-160173, VDB-160172 and VDB-160171. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Domain Name Software

Vendor

• ISC

Name

• BIND

Version

• 9.9.0
• 9.9.1
• 9.9.2
• 9.9.3
• 9.9.3-S1
• 9.9.4
• 9.9.5
• 9.9.6
• 9.9.7
• 9.9.8
• 9.9.9
• 9.9.10
• 9.9.11
• 9.9.12
• 9.9.13
• 9.10.0
• 9.10.1
• 9.10.2
• 9.10.3
• 9.10.4
• 9.10.5
• 9.10.6
• 9.10.7
• 9.10.8
• 9.11.0
• 9.11.1
• 9.11.2
• 9.11.3
• 9.11.3-S1
• 9.11.4
• 9.11.5
• 9.11.6
• 9.11.7
• 9.11.8
• 9.11.9
• 9.11.10
• 9.11.11
• 9.11.12
• 9.11.13
• 9.11.14
• 9.11.15
• 9.11.16
• 9.11.17
• 9.11.18
• 9.11.19
• 9.11.20
• 9.11.21
• 9.11.21-S1
• 9.16.0
• 9.16.1
• 9.16.2
• 9.16.3
• 9.16.4
• 9.16.5
• 9.17.0
• 9.17.1
• 9.17.2
• 9.17.3

License

• open-source

Website

• Vendor: https://www.isc.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion