CVE-2020-8624

CVE	CVE-2020-8624
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-08-21 21:15:00 UTC
Updated	2023-11-07 03:26:00 UTC
Description	In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Problem Types: CWE-269

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	20.04	All	All	All
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Application	Isc	Bind	9.11.21	s1	All	All
Application	Isc	Bind	9.11.3	s1	All	All
Application	Isc	Bind	9.9.12	s1	All	All
Application	Isc	Bind	9.9.13	s1	All	All
Application	Isc	Bind	9.11.21	s1	All	All
Application	Isc	Bind	9.11.3	s1	All	All
Application	Isc	Bind	9.9.12	s1	All	All
Application	Isc	Bind	9.9.13	s1	All	All
Application	Isc	Bind	All	All	All	All
Application	Isc	Bind	All	All	All	All
Application	Isc	Bind	All	All	All	All
Application	Isc	Bind	All	All	All	All
Application	Isc	Bind	All	All	All	All
Application	Netapp	Steelstore Cloud Integrated Storage	-	All	All	All
Operating System	Opensuse	Leap	15.1	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All

Reference	Source	Link	Tags
[security-announce] openSUSE-SU-2020:1699-1: moderate: Security update f	SUSE	lists.opensuse.org
USN-4468-1: Bind vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
BIND: Multiple vulnerabilities (GLSA 202008-19) — Gentoo security	GENTOO	security.gentoo.org
[SECURITY] Fedora 31 Update: bind-dyndb-ldap-11.2-4.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Debian -- Security Information -- DSA-4752-1 bind9	DEBIAN	www.debian.org
[security-announce] openSUSE-SU-2020:1701-1: moderate: Security update f	SUSE	lists.opensuse.org
[SECURITY] Fedora 32 Update: bind-9.11.22-1.fc32 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
August 2020 ISC BIND Vulnerabilities in NetApp Products \| NetApp Product Security	CONFIRM	security.netapp.com
[SECURITY] Fedora 32 Update: bind-9.11.22-1.fc32 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
Synology Inc.	CONFIRM	www.synology.com
CVE-2020-8624: update-policy rules of type "subdomain" are enforced incorrectly - Security Advisories	CONFIRM	kb.isc.org	Vendor Advisory
[SECURITY] Fedora 31 Update: bind-dyndb-ldap-11.2-4.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

LEGACY: ISC would like to thank Joop Boonen of credativ GmbH for bringing this vulnerability to our attention.