CVE-2020-8618: A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer
An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2020-8618?
CVE-2020-8618 is a vulnerability that allows an attacker with zone transfer permissions to trigger an assertion failure, causing a denial of service.
How does CVE-2020-8618 impact Bind9?
CVE-2020-8618 affects Bind9 versions 9.11.5.P4+dfsg-5.1+deb10u7, 9.11.5.P4+dfsg-5.1+deb10u9, 9.16.44-1~deb11u1, 9.18.19-1~deb12u1, and 9.19.17-1 on Debian, and 9.16.1-0ubuntu2.2 on Ubuntu Focal.
Is there a fix for CVE-2020-8618 in Bind9?
Yes, there are fixes available for CVE-2020-8618 in Bind9. For Debian, update to version 1:9.11.5.P4+dfsg-5.1+deb10u9 or later. For Ubuntu Focal, update to version 1:9.16.1-0ubuntu2.2 or later.
Are there any other affected software by CVE-2020-8618?
Yes, there are other affected software. The vulnerability also impacts openSUSE Leap 15.1 and 15.2, Netapp Steelstore Cloud Integrated Storage, and Canonical Ubuntu Linux 20.04.
What is the severity rating of CVE-2020-8618?
CVE-2020-8618 has a severity rating of medium, with a CVSS score of 4.9.