CVEvulnerability

CVE-2020-8616

8.6 HIGH Published 2020-05-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-05-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-400

Description

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

Affected configurations

• isc bind (>= 9.0.0 <= 9.11.18) • isc bind (>= 9.12.0 <= 9.12.4) • isc bind (>= 9.13.0 <= 9.13.7) • isc bind (>= 9.14.0 <= 9.14.11) • isc bind (>= 9.15.0 <= 9.15.6) • isc bind (>= 9.16.0 <= 9.16.2) • isc bind (>= 9.17.0 <= 9.17.1) • isc bind 9.12.4 • isc bind 9.9.3 • isc bind 9.10.5 • isc bind 9.10.7 • isc bind 9.11.3 • isc bind 9.11.5 • isc bind 9.11.6 • isc bind 9.11.7 • isc bind 9.11.8 • debian debian linux 9.0 • debian debian linux 10.0

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References