Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-8623: BIND DNS Server Crashes from Malicious Query
CVE-2020-8623 · published 6 years ago
Summary
A flaw in certain versions of the BIND DNS server makes it possible for an attacker to crash the server with a specially crafted query. This only affects systems that use a specific type of key to sign their DNS zones and can receive incoming queries from the internet. To stay secure, update to a fixed version of BIND.
What to do
- Update synology dns_server to version 2.2.2-5027 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| isc | bind |
>= 9.10.0, <= 9.11.21 >= 9.12.1, <= 9.16.5 >= 9.17.0, <= 9.17.3 9.10.5 9.11.21 cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* |
| fedoraproject | fedora |
31 32 cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* |
| opensuse | leap |
15.1 15.2 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
| debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
16.04 18.04 20.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
| synology | dns_server |
< 2.2.2-5027 cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:* |
| netapp | steelstore_cloud_integrated_storage |
All versions
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* |
Original advisory text
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a sp...
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker
References
- https://usn.ubuntu.com/4468-1/ Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html Mailing List Third Party Advisory
- https://kb.isc.org/docs/cve-2020-8623 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202008-19 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200827-0003/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4752 Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_19 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-617Reachable Assertion
Timeline
Published21 Aug 2020
Updated23 Oct 2026
First seen2 Apr 2026
Track software like this
Free during beta