CVE-2020-8624

update-policy rules of type "subdomain" are enforced incorrectly

State: Published
Severity: 4.3 Medium
Published: Aug 21, 2020
Updated: Sep 16, 2024
Reserved: Feb 5, 2020

Description

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	isc

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
BIND9ISC	9.9.12 to before unspecifiedAffected 9.9.13 and earlierAffected 9.10.7 to before unspecifiedAffected 9.10.8 and earlierAffected 9.11.3 to before unspecifiedAffected before 9.11.22Affected 9.12.1 to before unspecifiedAffected before 9.16.6Affected 9.17.0 to before unspecifiedAffected before 9.17.4Affected 9.9.12-S1 to before unspecifiedAffected 9.9.13-S1 and earlierAffected 9.11.3-S1 to before unspecifiedAffected before 9.11.22-S1Affected

Product

Versions

BIND9ISC

9.9.12 to before unspecifiedAffected
9.9.13 and earlierAffected
9.10.7 to before unspecifiedAffected
9.10.8 and earlierAffected
9.11.3 to before unspecifiedAffected
before 9.11.22Affected
9.12.1 to before unspecifiedAffected
before 9.16.6Affected
9.17.0 to before unspecifiedAffected
before 9.17.4Affected
9.9.12-S1 to before unspecifiedAffected
9.9.13-S1 and earlierAffected
9.11.3-S1 to before unspecifiedAffected
before 9.11.22-S1Affected

References

https://kb.isc.org/docs/cve-2020-8624
FEDORA-2020-a02b7a0f21vendor-advisory
https://security.netapp.com/advisory/ntap-20200827-0003/
USN-4468-1vendor-advisory
DSA-4752vendor-advisory
FEDORA-2020-14c194e5afvendor-advisory
GLSA-202008-19vendor-advisory
https://www.synology.com/security/advisory/Synology_SA_20_19
openSUSE-SU-2020:1699vendor-advisory
openSUSE-SU-2020:1701vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.