CVE-2020-8617
HIGHBIND 9.0.0-9.11.17 - Denial of Service via TSIG Key Assertion Failure
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2020-8617.
PoCs published by Teppei Fukuda, knqyf263, gothburz, including Metasploit module auxiliary/dos/dns/bind_tsig_badtime.
AI-analyzed exploit summary This exploit leverages a DNS TSIG vulnerability (CVE-2020-8617) by crafting a malformed DNS request with a TSIG record to trigger a denial-of-service condition in BIND 9.16.0. The PoC sends a DNS query with an invalid TSIG record to a local DNS server, potentially causing it to crash.
Description
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
Exploits (4)
This exploit leverages a DNS TSIG vulnerability (CVE-2020-8617) by crafting a malformed DNS request with a TSIG record to trigger a denial-of-service condition in BIND 9.16.0. The PoC sends a DNS query with an invalid TSIG record to a local DNS server, potentially causing it to crash.
This repository contains a functional PoC for CVE-2020-8617, a vulnerability in BIND9's TSIG authentication mechanism. The exploit uses a crafted DNS request with a malformed TSIG record to trigger the vulnerability, demonstrated via a Dockerized BIND9 server and a Python script using Scapy.
This repository contains a Dockerized exploit for CVE-2020-8617, which targets a vulnerability in the BIND DNS server. The Dockerfile sets up the environment and clones the actual exploit code from another repository, while the entrypoint script modifies the target IP before execution.
This Metasploit module exploits a logic error in BIND's TSIG validity check (CVE-2020-8617) to trigger a denial-of-service via a crafted DNS query with a malformed TSIG record. The payload sends a UDP packet with a spoofed source address to crash the BIND service.
References (12)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H