CVE-2015-5477

HIGH

Description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html

http://marc.info/?l=bugtraq&m=144000632319155&w=2

http://marc.info/?l=bugtraq&m=144017354030745&w=2

http://marc.info/?l=bugtraq&m=144181171013996&w=2

http://marc.info/?l=bugtraq&m=144294073801304&w=2

http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html

http://rhn.redhat.com/errata/RHSA-2015-1513.html

http://rhn.redhat.com/errata/RHSA-2015-1514.html

http://rhn.redhat.com/errata/RHSA-2015-1515.html

http://rhn.redhat.com/errata/RHSA-2016-0078.html

http://rhn.redhat.com/errata/RHSA-2016-0079.html

http://www.debian.org/security/2015/dsa-3319

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.securityfocus.com/bid/76092

http://www.securitytracker.com/id/1033100

http://www.ubuntu.com/usn/USN-2693-1

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918

https://kb.isc.org/article/AA-01272

https://kb.isc.org/article/AA-01305

https://kb.isc.org/article/AA-01306

https://kb.isc.org/article/AA-01307

https://kb.isc.org/article/AA-01438

https://kb.juniper.net/JSA10783

https://kc.mcafee.com/corporate/index?page=content&id=SB10126

https://security.gentoo.org/glsa/201510-01

https://security.netapp.com/advisory/ntap-20160114-0001/

https://support.apple.com/kb/HT205032

https://www.exploit-db.com/exploits/37721/

https://www.exploit-db.com/exploits/37723/

Details

Source: MITRE

Published: 2015-07-29

Updated: 2017-11-10

Type: CWE-19

Risk Information

CVSS v2.0

Base Score: 7.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:isc:bind:*:p1:*:*:*:*:*:* versions up to 9.9.7 (inclusive)

cpe:2.3:a:isc:bind:*:p2:*:*:*:*:*:* versions up to 9.10.2 (inclusive)

Tenable Plugins

View all (45 total)

IDNameProductFamilySeverity
137170OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)NessusOracleVM Local Security Checks
critical
124936EulerOS Virtualization 3.0.1.0 : bind (EulerOS-SA-2019-1433)NessusHuawei Local Security Checks
medium
99569OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)NessusOracleVM Local Security Checks
critical
9865ISC BIND 9.x < 9.9.7-P2 / 9.9.8 / 9.9.8-S1 / 9.9.9-S3 / 9.10.2-P3 / 9.10.3 / 9.10.3rc DoSNessus Network MonitorDNS Servers
high
91739OracleVM 3.2 : bind (OVMSA-2016-0055)NessusOracleVM Local Security Checks
high
88480RHEL 6 : bind (RHSA-2016:0079)NessusRed Hat Local Security Checks
high
88479RHEL 6 : bind (RHSA-2016:0078)NessusRed Hat Local Security Checks
high
88178SUSE SLES10 Security Update : bind (SUSE-SU-2016:0227-1)NessusSuSE Local Security Checks
high
88093Juniper Junos TKEY Query Handling DoS (JSA10718)NessusJunos Local Security Checks
high
86435GLSA-201510-01 : BIND: Denial of ServiceNessusGentoo Local Security Checks
high
86011F5 Networks BIG-IP : BIND vulnerability (K16909)NessusF5 Networks Local Security Checks
high
85450AIX 5.3 TL 12 : bind9 (IV75966)NessusAIX Local Security Checks
high
85417AIX 6.1 TL 8 : bind9 (IV75694)NessusAIX Local Security Checks
high
85416AIX 7.1 TL 3 : bind9 (IV75693)NessusAIX Local Security Checks
high
85415AIX 6.1 TL 9 : bind9 (IV75692)NessusAIX Local Security Checks
high
85414AIX 7.1 TL 2 : bind9 (IV75690)NessusAIX Local Security Checks
high
85410Mac OS X : OS X Server < 4.1.5 BIND DoSNessusMacOS X Local Security Checks
high
85402McAfee Firewall Enterprise DoS (SB10126)NessusFirewalls
high
85241ISC BIND 9.7.x < 9.9.7-P2 / 9.10.x < 9.10.2-P3 TKEY Query Handling Remote DoSNessusDNS
high
85211Scientific Linux Security Update : bind on SL6.x, SL7.x i386/x86_64 (20150729)NessusScientific Linux Local Security Checks
high
85187openSUSE Security Update : bind (openSUSE-2015-530)NessusSuSE Local Security Checks
high
85179SUSE SLES10 Security Update : bind (SUSE-SU-2015:1322-1)NessusSuSE Local Security Checks
high
85171Fedora 21 : bind-9.9.6-10.P1.fc21 (2015-12357)NessusFedora Local Security Checks
high
85170Fedora 22 : bind-9.10.2-4.P3.fc22 (2015-12335)NessusFedora Local Security Checks
high
85169Fedora 22 : bind99-9.9.7-6.P2.fc22 (2015-12316)NessusFedora Local Security Checks
high
85151SUSE SLES11 Security Update : bind (SUSE-SU-2015:1316-1)NessusSuSE Local Security Checks
high
85146OracleVM 3.3 : bind (OVMSA-2015-0105)NessusOracleVM Local Security Checks
high
85121SUSE SLED11 / SLES11 Security Update : bind (SUSE-SU-2015:1304-1)NessusSuSE Local Security Checks
high
85120Scientific Linux Security Update : bind on SL5.x i386/x86_64 (20150729)NessusScientific Linux Local Security Checks
high
85119Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20150729)NessusScientific Linux Local Security Checks
high
85117Oracle Linux 5 : bind97 (ELSA-2015-1515)NessusOracle Linux Local Security Checks
high
85116Oracle Linux 5 : bind (ELSA-2015-1514)NessusOracle Linux Local Security Checks
high
85081Ubuntu 12.04 LTS / 14.04 LTS / 15.04 : bind9 vulnerabilities (USN-2693-1)NessusUbuntu Local Security Checks
high
85070RHEL 5 : bind97 (RHSA-2015:1515)NessusRed Hat Local Security Checks
high
85069RHEL 5 : bind (RHSA-2015:1514)NessusRed Hat Local Security Checks
high
85068RHEL 6 / 7 : bind (RHSA-2015:1513)NessusRed Hat Local Security Checks
high
85067Oracle Linux 6 / 7 : bind (ELSA-2015-1513)NessusOracle Linux Local Security Checks
high
85066FreeBSD : bind -- denial of service vulnerability (731cdeaa-3564-11e5-9970-14dae9d210b8)NessusFreeBSD Local Security Checks
high
85053Debian DSA-3319-1 : bind9 - security updateNessusDebian Local Security Checks
high
85052Debian DLA-285-1 : bind9 security updateNessusDebian Local Security Checks
high
85049CentOS 5 : bind97 (CESA-2015:1515)NessusCentOS Local Security Checks
high
85048CentOS 5 : bind (CESA-2015:1514)NessusCentOS Local Security Checks
high
85047CentOS 6 / 7 : bind (CESA-2015:1513)NessusCentOS Local Security Checks
high
85044Amazon Linux AMI : bind (ALAS-2015-573)NessusAmazon Linux Local Security Checks
high
85043Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : bind (SSA:2015-209-01)NessusSlackware Local Security Checks
high