CVE-2020-8616: BIND does not sufficiently limit the number of fetches performed when processing referrals
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2020-8616?
CVE-2020-8616 is a vulnerability that allows a malicious actor to exploit a lack of effective limitation on the number of fetches performed when processing referrals.
How can a malicious actor exploit CVE-2020-8616?
A malicious actor can exploit CVE-2020-8616 by using specially crafted referrals to cause a recursing server to issue a large number of fetches.
What is the severity of CVE-2020-8616?
CVE-2020-8616 has a severity value of 8.6, which is considered high.
Which software is affected by CVE-2020-8616?
The affected software includes bind9 versions 9.11.5.P4+dfsg-5.1+deb10u7, 9.11.5.P4+dfsg-5.1+deb10u9, 9.16.44-1~deb11u1, 9.18.19-1~deb12u1, and 9.19.17-1, as well as other specific versions of bind9 for different distributions.
How do I fix CVE-2020-8616?
To fix CVE-2020-8616, it is recommended to update to the patched versions of bind9 provided by the respective distributions.