[Forgot Password]
Login  Register Subscribe

30430

 
 

423868

 
 

247621

 
 

909

 
 

194512

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2020-8616Date: (C)2020-05-20   (M)2024-01-26


A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 8.6CVSS Score : 5.0
Exploit Score: 3.9Exploit Score: 10.0
Impact Score: 4.0Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: LOW
Privileges Required: NONEAuthentication: NONE
User Interaction: NONEConfidentiality: NONE
Scope: CHANGEDIntegrity: NONE
Confidentiality: NONEAvailability: PARTIAL
Integrity: NONE 
Availability: HIGH 
  
Reference:
DSA-4689
FEDORA-2020-2d89cbcfd9
FEDORA-2020-f9dcd4e9d5
USN-4365-1
USN-4365-2
https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html
http://www.openwall.com/lists/oss-security/2020/05/19/4
http://www.nxnsattack.com
https://kb.isc.org/docs/cve-2020-8616
https://security.netapp.com/advisory/ntap-20200522-0002/
https://www.synology.com/security/advisory/Synology_SA_20_12
openSUSE-SU-2020:1699
openSUSE-SU-2020:1701

CPE    4
cpe:/o:debian:debian_linux:9.0
cpe:/a:isc:bind
cpe:/a:isc:bind:9.11.8:s1:~~supported_preview~~~
cpe:/a:isc:bind:9.9.3:s1:~~supported_preview~~~
...
CWE    1
CWE-400
OVAL    28
oval:org.secpod.oval:def:64116
oval:org.secpod.oval:def:64144
oval:org.secpod.oval:def:89002989
oval:org.secpod.oval:def:64051
...

© SecPod Technologies