Vulnerability record · CVE-2020-8625 · published 17 February 2021
CVE-2020-8625: BIND GSS-TSIG buffer overflow in named
Isc · Bind
BIND's named process contains a classic buffer overflow (CWE-120) reachable when GSS-TSIG is enabled via the tkey-gssapi-keytab or tkey-gssapi-credential options. Default configurations do not expose the vulnerable code path, but GSS-TSIG is common where BIND integrates with Samba or Active Directory. The most likely outcome is a crash of named, with remote code execution described as theoretically possible but unproven.
Description
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.1 and a very high EPSS percentile indicate significant risk, though exploitation requires non-default GSS-TSIG configuration and confirmed impact is limited to denial of service.
What it is
BIND's named process contains a classic buffer overflow (CWE-120) reachable when GSS-TSIG is enabled via the tkey-gssapi-keytab or tkey-gssapi-credential options. Default configurations do not expose the vulnerable code path, but GSS-TSIG is common where BIND integrates with Samba or Active Directory. The most likely outcome is a crash of named, with remote code execution described as theoretically possible but unproven.
Impact
An attacker can crash the named process, causing denial of service for DNS resolution. The record states remote code execution is theoretically possible but unproven, so code execution should not be assumed.
Attack surface
Reachable over the network (AV:N) with no privileges or user interaction required (PR:N, UI:N), but only against servers explicitly configured for GSS-TSIG. The high attack complexity (AC:H) reflects the conditions needed to trigger the overflow.
Exploitation
Not listed in CISA KEV and no ransomware groups are documented using it. EPSS is high (0.64161, 99.19th percentile), and references include patch and vendor advisory tags but no public exploit tag.
What to do
- Upgrade BIND to a fixed release for your branch; affected ranges are 9.5.0-9.11.27, 9.12.0-9.16.11, 9.11.3-S1-9.11.27-S1, 9.16.8-S1-9.16.11-S1, and 9.17.0-9.17.1.
- If GSS-TSIG is not required, remove or do not set tkey-gssapi-keytab and tkey-gssapi-credential so the vulnerable code path stays unexposed.
- Where GSS-TSIG is required, restrict DNS and GSS-TSIG traffic to trusted internal hosts and apply vendor mitigations from the ISC advisory.
- Track vendor advisories for Debian, Fedora, Siemens, and NetApp products that bundle affected BIND versions.
- Monitor named for unexpected restarts or crashes as an interim indicator until patching completes.
Detection
- Alert on named process crashes, core dumps, or unexpected restarts, especially on servers with GSS-TSIG configured.
- Audit BIND configurations for tkey-gssapi-keytab or tkey-gssapi-credential to inventory exposed servers.
- Monitor network traffic to DNS servers from untrusted sources for anomalous GSS-TSIG or TKEY requests.
- Correlate named crash events with concurrent DNS query anomalies to identify possible exploitation attempts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-8625 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-8625), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
