{"id":"CVE-2020-8617","published":"2020-05-19T14:05:16Z","modified":"2024-09-16T20:26:32Z","title":"A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c","vendor":"ISC","product":"BIND9","tier":"core","eol":null,"affectedVersions":[{"vendor":"ISC","product":"BIND9","versions":["9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1"]}],"description":{"text":"Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.","provenance":"source","from":"CVE.org"},"summary":{"text":"A logic error in BIND9 (ISC's DNS server), in the code that checks TSIG validity in tsig.c, can be triggered to cause an assertion failure. An attacker who sends a specially crafted message over the network, without authentication or user interaction, can do so if they know or successfully guess the name of a TSIG key used by the server, which is commonly the default local session key present on most BIND servers.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:03Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.93332,"percentile":0.99837,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://kb.isc.org/docs/cve-2020-8617","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2020/05/19/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2020/dsa-4689","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://security.netapp.com/advisory/ntap-20200522-0002/","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html","tags":["x_refsource_MISC"]},{"url":"https://usn.ubuntu.com/4365-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4365-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-29465","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29465","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":48521,"url":"https://www.exploit-db.com/exploits/48521","title":"BIND - 'TSIG' Denial of Service","type":"dos","platform":"multiple","date":"2020-05-20","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-05-20"},"pocGithub":{"count":1,"skipped":1,"earliest":"2020-05-20","earliestUrl":"https://github.com/knqyf263/CVE-2020-8617","repos":[{"name":"knqyf263/CVE-2020-8617","url":"https://github.com/knqyf263/CVE-2020-8617","stars":45,"created":"2020-05-20"}]},"metasploit":[{"name":"BIND TSIG Badtime Query Denial of Service","module":"auxiliary/dos/dns/bind_tsig_badtime","type":"auxiliary","disclosureDate":"2020-05-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tsig_badtime.rb"}],"first":{"date":"2020-05-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tsig_badtime.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html"],"flow":[],"timeline":[{"date":"2020-05-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-8617","provenance":"source"},{"date":"2020-05-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2020-05-20, PoC-in-GitHub 2020-05-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tsig_badtime.rb","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":30.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}