CVEvulnerability

CVE-2020-8619

4.9 MEDIUM Published 2020-06-17 Modified 2026-09-01 Official page ↗
Status
Modified
Published
2020-06-17
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P
Weaknesses
CWE-404

Description

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

Affected configurations

• isc bind (>= 9.11.14 <= 9.11.19) • isc bind (>= 9.11.14-s1 <= 9.11.19-s1) • isc bind (>= 9.14.9 <= 9.14.12) • isc bind (>= 9.16.0 <= 9.16.3) • fedoraproject fedora 31 • fedoraproject fedora 32 • opensuse leap 15.1 • opensuse leap 15.2 • debian debian linux 10.0 • canonical ubuntu linux 20.04 • netapp steelstore cloud integrated storage

Related

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References