CVE-2020-8625 — A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

Description

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Affected products

Vendor	Product	Affected	Fixed
ISC	BIND9	Open Source Branches 9.5 though 9.11 9.5.0 through versions before 9.11.28, Open Source Branches 9.12 though 9.16 9.12.0 through versions before 9.16.12, Supported Preview Branch 9.11-S 9.11.3-S1 through versions before 9.11.28-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9…	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	bind9	1:9.16.12-1	—
Debian 13	bind9	1:9.16.12-1	—
Debian 12	bind9	1:9.16.12-1	—
Debian 10	bind9	1:9.11.5.P4+dfsg-5.1+deb10u3	DSA-4857-1
Debian 9	bind9	1:9.10.3.dfsg.P4-12.3+deb9u8	DLA-2568-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	bind9	1:9.16.1-0ubuntu2.6	USN-4737-1
Ubuntu 18.04 LTS	bind9	1:9.11.3+dfsg-1ubuntu1.14	USN-4737-1
Ubuntu 16.04 LTS	bind9	1:9.10.3.dfsg.P4-8ubuntu1.18	USN-4737-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 14.04 LTS	bind9	1:9.9.5.dfsg-3ubuntu0.19+esm4	USN-4737-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	bind +16	32:9.11.20-5.el8_3.1	RHSA-2021:0670
RHEL 7	bind +15	32:9.11.4-26.P2.el7_9.4	RHSA-2021:0671

Show 10 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.2 EUS	bind +16	32:9.11.13-6.el8_2.2	RHSA-2021:0922
RHEL 8.1 EUS	bind +16	32:9.11.4-26.P2.el8_1.4	RHSA-2021:0669
RHEL 7.7 EUS	bind +15	32:9.11.4-9.P2.el7_7.4	RHSA-2021:0727
RHEL 7.6 EUS	bind +13	32:9.9.4-74.el7_6.6	RHSA-2021:0691
RHEL 7.4 TUS	bind +13	32:9.9.4-51.el7_4.5	RHSA-2021:0692
RHEL 7.4 E4S	bind +13	32:9.9.4-51.el7_4.5	RHSA-2021:0692
RHEL 7.4 AUS	bind +13	32:9.9.4-51.el7_4.5	RHSA-2021:0692
RHEL 7.3 AUS	bind +13	32:9.9.4-50.el7_3.5	RHSA-2021:0693
RHEL 7.2 AUS	bind +13	32:9.9.4-29.el7_2.10	RHSA-2021:0694
RHEL 6 ELS	bind +5	32:9.8.2-0.68.rc1.el6_10.10	RHSA-2021:0672

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP2	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SLES 15 SP1	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SLES 15	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SLES 12 SP5	bind	9.11.22-3.29.1	SUSE-SU-2021:0503-1
SLES 12 SP4	bind	9.11.22-3.29.1	SUSE-SU-2021:0503-1

Show 22 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP3	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SLES 12 SP2	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SLES 11 SP4	bind	9.9.6P1-0.51.23.1	SUSE-SU-2021:14632-1
SLES for SAP 15 SP1	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SLES for SAP 15	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SLES for SAP 12 SP5	bind	9.11.22-3.29.1	SUSE-SU-2021:0503-1
SLES for SAP 12 SP4	bind	9.11.22-3.29.1	SUSE-SU-2021:0503-1
SLES for SAP 12 SP3	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SLES for SAP 12 SP2	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SLE HPC 15 SP1	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SLE HPC 15	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SUSE OpenStack Cloud Crowbar 9	bind	9.11.22-3.29.1	SUSE-SU-2021:0503-1
SUSE OpenStack Cloud Crowbar 8	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SUSE OpenStack Cloud 9	bind	9.11.22-3.29.1	SUSE-SU-2021:0503-1
SUSE OpenStack Cloud 8	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SUSE OpenStack Cloud 7	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SUSE Manager Server 4.0	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SUSE Manager Retail Branch Server 4.0	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SUSE Manager Proxy 4.0	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1
SUSE Linux Enterprise Point of Sale 11 SP3	bind	9.9.6P1-0.51.23.1	SUSE-SU-2021:14632-1
SUSE HPE Helion OpenStack 8	bind	9.9.9P1-63.20.1	SUSE-SU-2021:0504-1
SUSE Enterprise Storage 6	bind	9.16.6-12.41.1	SUSE-SU-2021:0507-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	bind	9.16.20-1.4	openSUSE-SU-2024:10650-1
openSUSE Leap 15.2	bind	9.16.6-lp152.14.12.1	openSUSE-SU-2021:0375-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	bind	9.16.11-r2	—
Alpine v3.23	bind	9.16.11-r2	—
Alpine v3.22	bind	9.16.11-r2	—
Alpine v3.21	bind	9.16.11-r2	—
Alpine v3.20	bind	9.16.11-r2	—

Show 10 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	bind	9.16.11-r2	—
Alpine v3.18	bind	9.16.11-r2	—
Alpine v3.17	bind	9.16.11-r2	—
Alpine v3.16	bind	9.16.11-r2	—
Alpine v3.15	bind	9.16.11-r2	—
Alpine v3.14	bind	9.16.11-r2	—
Alpine v3.13	bind	9.16.11-r2	—
Alpine v3.12	bind	9.16.11-r2	—
Alpine v3.11	bind	9.16.11-r2	—
Alpine v3.10	bind	9.16.11-r2	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	bind +15	32:9.11.4-26.P2.amzn2.4	ALAS2-2021-1614

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	bind +16	32:9.11.20-5.el8_3.1	ELSA-2021-0670
Oracle Linux 7	bind +15	32:9.11.4-26.P2.el7_9.4	ELSA-2021-0671

Advisories 26

RHSA-2021:0922 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0671 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0672 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0691 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0692 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0693 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0694 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0669 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0727 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2021:0670 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
USN-4737-2 bind9 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
USN-4737-1 bind9 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-4857-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2568-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
openSUSE-SU-2021:0375-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:0504-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:14632-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:0507-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:10650-1 bind-9.16.20-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:0503-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-0063 Juniper Junos Space: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2025
ICSA-22-069-09 Siemens SINEC INS CISA ICS & IT advisories · May 6, 2025
SSA-389290 SSA-389290: Third-Party Component Vulnerabilities in SINEC INS Siemens ProductCERT · Mar 8, 2022
ALAS2-2021-1614 Important: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 19, 2021
ELSA-2021-0670 Important: bind security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 2, 2021
ELSA-2021-0671 Important: bind security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 2, 2021

References

https://kb.isc.org/v1/docs/cve-2020-8625
DSA-4857 vendor-advisory
[oss-security] 20210218 BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination mailing-list
[debian-lts-announce] 20210219 [SECURITY] [DLA 2568-1] bind9 security update mailing-list
[oss-security] 20210220 BIND Operational Notification: Zone journal (.jnl) file incompatibility,after upgrading to BIND 9.16.12 and 9.17 mailing-list
https://www.zerodayinitiative.com/advisories/ZDI-21-195/
FEDORA-2021-0595625865 vendor-advisory
FEDORA-2021-28f97e232d vendor-advisory
https://security.netapp.com/advisory/ntap-20210319-0001/
FEDORA-2021-8b4744f152 vendor-advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

CNA	v3.1	8.1
EUVD	v3.1	8.1