Live › vulnerability › CVE-2015-5477
Go to dashboardA crafted TKEY query makes BIND's named exit on a REQUIRE assertion failure, a remote unauthenticated denial of service. Recursive and authoritative servers are both affected. ACLs and config do not help, because the bug is hit early in packet handling. ISC says a third party has published PoC exploit code, and CISA lists it as exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ISC BIND | vendor | – | – |
| BIND | vendor | >= 9.1.0, <= 9.8.x; >= 9.9.0, <= 9.9.7-P1; >= 9.10.0, <= 9.10.2-P2 | 9.9.7-P2, 9.10.2-P3 |
| juniper junos | vendor | < 12.1 | 12.1 |
| juniper junos | vendor | >= 13.1, < 13.2 | 13.2 |
| juniper junos | vendor | = 12.1 | – |
| juniper junos | vendor | = 12.1r | – |
| juniper junos | vendor | = 12.1x44 | – |
| juniper junos | vendor | = 12.1x45 | – |
| juniper junos | vendor | = 12.1x46 | – |
| juniper junos | vendor | = 12.1x47 | – |
| juniper junos | vendor | = 12.3 | – |
| juniper junos | vendor | = 12.3x48 | – |
| juniper junos | vendor | = 12.3x50 | – |
| juniper junos | vendor | = 13.2 | – |
| juniper junos | vendor | = 13.2x51 | – |
| juniper junos | vendor | = 14.1 | – |
| juniper junos | vendor | = 14.1x50 | – |
| juniper junos | vendor | = 14.1x51 | – |
| juniper junos | vendor | = 14.1x53 | – |
| juniper junos | vendor | = 14.2 | – |
| juniper junos | vendor | = 15.1 | – |
| juniper junos | vendor | = 15.1x49 | – |
| juniper junos | vendor | = 15.1x53 | – |
| fedoraproject fedora | vendor | = 21 | – |
| fedoraproject fedora | vendor | = 22 | – |
| redhat enterprise linux | vendor | = 5.0 | – |
| redhat enterprise linux | vendor | = 6.0 | – |
| redhat enterprise linux | vendor | = 7.0 | – |
| redhat enterprise linux aus | vendor | = 6.4 | – |
| redhat enterprise linux aus | vendor | = 6.5 | – |
| redhat enterprise linux aus | vendor | = 6.6 | – |
| debian linux | vendor | = 7.0 | – |
| debian linux | vendor | = 8.0 | – |
| oracle vm server | vendor | = 3.2 | – |
| oracle solaris | vendor | = 10 | – |
| oracle solaris | vendor | = 11.2 | – |
| hp hp-ux | vendor | = 11.11 | – |
| hp hp-ux | vendor | = 11.23 | – |
| hp hp-ux | vendor | = 11.31 | – |
| canonical ubuntu linux | vendor | = 12.04 | – |
| netapp clustered data ontap | vendor | – | – |
| apple os x server | vendor | = 4.1.5 | – |
named -v (or dig @server version.bind chaos txt if exposed)9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1, 9.10.0 through 9.10.2-P29.9.7-P2 or 9.10.2-P3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2015-5477")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.