Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 7 & 8 MGASA-2021-0110 Moderate: BIND Daemon Crash Risk

mageia
Calendar Grey March 4, 2021
Dist Mageia Esm H88
A vulnerability in the implementation of SPNEGO within BIND may result in service interruption and poses a risk for potential unauthorized code execution.
A buffer overflow vulnerability was discovered in the SPNEGO implementation affecting the GSSAPI security policy negotiation in BIND, which could result in denial of service (daemo...

Summary

A buffer overflow vulnerability was discovered in the SPNEGO implementation affecting the GSSAPI security policy negotiation in BIND, which could result in denial of service (daemon crash), or potentially the execution of arbitrary code (CVE-2020-8625).
The default configuration is not vulnerable to this issue, but it is if the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options are set.

References

- https://bugs.mageia.org/show_bug.cgi?id=28394

- https://kb.isc.org/docs/cve-2020-8625

- https://lists.debian.org/debian-security-announce/2021/msg00038.html

- https://www.cve.org/CVERecord?id=CVE-2020-8625

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow risk mitigation BIND Moderate GSSAPI daemon crash Mageia

Resolution

SRPMS

- 7/core/bind-9.11.6-1.3.mga7

- 8/core/bind-9.11.27-1.1.mga8

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 04 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0110.html
Type: security
CVE: CVE-2020-8625

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow risk mitigation BIND Moderate GSSAPI daemon crash Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here