Skip to content
OpenAdvisories
High ELSA-2020-2344 2 CVEs

Important: bind security update (Oracle Linux 7)

Published Jun 1, 2020 · Updated Jun 1, 2020

Ecosystem: Oracle Linux

Summary

[32:9.11.4-16.P2.6]
- Fix EDNS512 loops on broken servers

[32:9.11.4-16.P2.5]
- Add CVE tests to codebase

[32:9.11.4-16.P2.4]
- Limit number of queries triggered by a request (CVE-2020-8616)
- Fix invalid tsig request (CVE-2020-8617)

[32:9.11.4-16.P2.3]
- Disable atomic operations on ppc64, ppc64le, aarch64, ppc (#1779589)

[32:9.11.4-16.P2.2]
- Disable unit test timer_test on ppc64le because of its instability

[32:9.11.4-16.P2.1]
- Prevent deadlock on reload (#1805685)

Fixed packages 16

ReleasePackageFixed in
Oracle Linux · 7 bind 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-chroot 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-devel 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-export-devel 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-export-libs 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-libs 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-libs-lite 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-license 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-lite-devel 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-pkcs11 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-pkcs11-devel 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-pkcs11-libs 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-pkcs11-utils 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-sdb 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-sdb-chroot 32:9.11.4-16.P2.el7_8.6
Oracle Linux · 7 bind-utils 32:9.11.4-16.P2.el7_8.6

Vulnerabilities 2

  • High 8.6
    CVE-2020-8616 EPSS 11%

    BIND does not sufficiently limit the number of fetches performed when processing referrals

    A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches i…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2020-8617 Public exploit EPSS 93%

    A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

    Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine