CVE-2020-8623 : Security Advisory and Response

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, an attacker can trigger a crash by sending a specially crafted query packet to a vulnerable system.

Understanding CVE-2020-8623

This CVE involves a flaw in native PKCS#11 code that can lead to a remotely triggerable assertion failure in pk11.c.

What is CVE-2020-8623?

This vulnerability affects BIND versions 9.10.0 to 9.11.21, 9.12.0 to 9.16.5, and 9.17.0 to 9.17.3, including specific versions of the BIND 9 Supported Preview Edition. An attacker exploiting this flaw can crash the system by sending a specially crafted query packet.

The Impact of CVE-2020-8623

CVSS Base Score: 7.5 (High)
Attack Vector: Network
Attack Complexity: Low
Availability Impact: High
Privileges Required: None
Scope: Unchanged
User Interaction: None
Confidentiality & Integrity Impact: None

Technical Details of CVE-2020-8623

This section provides more in-depth technical information about the vulnerability.

Vulnerability Description

If BIND is built with "--enable-native-pkcs11," a specially crafted query for a zone signed with RSA can trigger an assertion failure.

Affected Systems and Versions

BIND 9.10.0 to 9.11.21
BIND 9.12.0 to 9.16.5
BIND 9.17.0 to 9.17.3
BIND Supported Preview Edition 9.10.5-S1 to 9.11.21-S1

Exploitation Mechanism

An attacker must send a specially crafted query packet to a vulnerable system running BIND built with "--enable-native-pkcs11" and signing zones with an RSA key.

Mitigation and Prevention

To address CVE-2020-8623, follow these mitigation strategies:

Immediate Steps to Take

Upgrade to the patched release closest to your current BIND version: BIND 9.11.22, BIND 9.16.6, BIND 9.17.4

Long-Term Security Practices

Regularly update BIND to the latest version
Implement network segmentation to limit exposure
Monitor for unusual DNS query activities

Patching and Updates

Upgrade to the recommended patched releases
Consider using BIND Supported Preview Edition for eligible ISC support customers