{"id":"CVE-2015-5477","kind":"vulnerability","aliases":["CVE-2015-5477"],"related":[],"title":"named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of…","description":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"A crafted TKEY query makes BIND's named exit on a REQUIRE assertion failure, a remote unauthenticated denial of service. Recursive and authoritative servers are both affected. ACLs and config do not help, because the bug is hit early in packet handling. ISC says a third party has published PoC exploit code, and CISA lists it as exploited.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-10-08T00:00:00+00:00","products":[{"name":"ISC BIND","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"BIND","fixed":["9.9.7-P2","9.10.2-P3"],"affected":">= 9.1.0, <= 9.8.x; >= 9.9.0, <= 9.9.7-P1; >= 9.10.0, <= 9.10.2-P2","ecosystem":"vendor"},{"name":"juniper junos","fixed":["12.1"],"affected":"< 12.1","ecosystem":"vendor"},{"name":"juniper junos","fixed":["13.2"],"affected":">= 13.1, < 13.2","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.1","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.1r","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.1x44","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.1x45","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.1x46","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.1x47","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.3","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.3x48","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 12.3x50","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 13.2","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 13.2x51","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 14.1","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 14.1x50","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 14.1x51","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 14.1x53","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 14.2","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 15.1","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 15.1x49","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 15.1x53","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 21","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 22","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux aus","fixed":[],"affected":"= 6.4","ecosystem":"vendor"},{"name":"redhat enterprise linux aus","fixed":[],"affected":"= 6.5","ecosystem":"vendor"},{"name":"redhat enterprise linux aus","fixed":[],"affected":"= 6.6","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"oracle vm server","fixed":[],"affected":"= 3.2","ecosystem":"vendor"},{"name":"oracle solaris","fixed":[],"affected":"= 10","ecosystem":"vendor"},{"name":"oracle solaris","fixed":[],"affected":"= 11.2","ecosystem":"vendor"},{"name":"hp hp-ux","fixed":[],"affected":"= 11.11","ecosystem":"vendor"},{"name":"hp hp-ux","fixed":[],"affected":"= 11.23","ecosystem":"vendor"},{"name":"hp hp-ux","fixed":[],"affected":"= 11.31","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 12.04","ecosystem":"vendor"},{"name":"netapp clustered data ontap","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple os x server","fixed":[],"affected":"= 4.1.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bind","dns","exploited","infrastructure","self-hosted"],"not_affected_if":["bind-not-installed","managed-dns"],"how_to_check":"Run 'named -v' (or 'dig @server version.bind chaos txt' if exposed). Vulnerable: BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1, 9.10.0 through 9.10.2-P2. Any named reachable on UDP/TCP 53 is exposed.","fix":"Upgrade to BIND 9.9.7-P2 or 9.10.2-P3 or later. Versions older than 9.9 are end of life, so move to a current supported release. ISC lists no workaround.","status":"resolved","published_at":"2015-07-29T14:59:05+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:01+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T19:50:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ISC BIND to a patched release per the ISC advisory; the sources do not name the fixed version. Apply vendor mitigations as CISA's required action directs.","summary":"ISC BIND has a data processing error in how it handles TKEY queries that lets a remote attacker crash the DNS server. CISA lists it as actively exploited, so the attack is being used in the wild.","category":"infrastructure","who_cares":["bind","dns","self-hosted"],"confidence":0.6,"analyst_note":"Find the affected and fixed BIND versions and the TKEY mitigation from the ISC advisory for CVE-2015-5477 (https://kb.isc.org) and the NVD entry, since the sources list affected and fixed as unknown.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-dns","bind-not-installed"],"severity_if_unknown":"high"},"cost_usd":0.000378,"input_tokens":2194,"output_tokens":317,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed BIND versions and the TKEY mitigation from the ISC advisory for CVE-2015-5477 (https://kb.isc.org) and the NVD entry, since the sources list affected and fixed as unknown.","search":"'-04':237C,263C,294C '-2015':24A,27A '-5477':25A,28A '26':236C,262C,293C '9':5A '9.10':11A '9.10.2':14A '9.9.7':8A 'accord':226C 'acl':167B 'action':222C 'adher':290C 'affect':166B 'allow':16A,208C 'apple':129A 'appli':223C 'applic':260C 'assert':152B 'asset':284C 'attack':18A,210C 'aus':90A,94A,98A 'authorit':162B 'base':241C 'bind':4A,30A,31A,133B,145B,199C 'bod':235C,261C,292C 'bug':175B 'canonical':122A 'caus':20A,212C 'cisa':193B,220C,233C,250C 'cloud':266C 'clustered':126A 'code':191B 'complianc':231C 'config':169B 'contain':200C 'could':207C 'craft':141B 'cve':23A,26A 'data':127A,202C 'debian':99A,101A 'denial':22A,157B,214C 'discontinu':269C 'dns':134B 'earli':178B 'ensur':230C,289C 'enterprise':79A,82A,85A,88A,92A,96A 'error':204C 'evalu':282C 'exit':148B 'exploit':135B,190B,197B 'exposur':287C 'failur':153B 'fedora':75A,77A 'fedoraproject':74A,76A 'follow':259C 'forens':252C 'guidanc':248C,264C 'guidelin':296C 'handl':181B 'help':172B 'hit':177B 'host':139B 'hp':110A,112A,114A,116A,118A,120A 'hp-ux':111A,115A,119A 'infrastructur':136B 'instruct':229C 'internet':286C 'isc':3A,29A,182B,198C 'juniper':32A,34A,36A,38A,40A,42A,44A,46A,48A,50A,52A,54A,56A,58A,60A,62A,64A,66A,68A,70A,72A 'junos':33A,35A,37A,39A,41A,43A,45A,47A,49A,51A,53A,55A,57A,59A,61A,63A,65A,67A,69A,71A,73A 'linux':80A,83A,86A,89A,93A,97A,100A,102A,124A 'list':194B 'make':144B 'mitig':224C,275C 'name':1A,147B 'netapp':125A 'note':247C,258C 'ontap':128A 'oracle':103A,106A,108A 'os':130A 'p2':9A 'p3':15A 'packet':180B 'parti':186B 'patch':295C 'poc':189B 'priorit':238C 'process':203C 'product':273C 'publish':188B 'queri':143B,219C 'recurs':160B 'redhat':78A,81A,84A,87A,91A,95A 'remot':17A,155B,209C 'requir':151B,221C,254C 'respons':280C 'risk':243C 'say':183B 'secur':239C 'see':244C,255C 'self':138B 'self-host':137B 'server':105A,132A,163B 'servic':159B,216C,267C 'solaris':107A,109A 'stakehold':278C 'third':185B 'tkey':142B,218C 'triag':253C 'ubuntu':123A 'unauthent':156B 'unavail':277C 'updat':240C 'url':245C,256C 'use':270C 'ux':113A,117A,121A 'vendor':228C 'via':217C 'vm':104A 'vulner':205C 'x':6A,12A,131A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-07-29T14:59:05+00:00","kev":{"dateAdded":"2026-10-08","dueDate":"2026-10-11","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-5477","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477","severity":null,"published_at":"2026-10-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T13:39:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2015-5477:110","url":null,"severity":null,"published_at":"2026-10-23T21:35:52+00:00","modified_at":"2026-10-23T21:35:52+00:00","first_seen_at":"2026-10-23T21:35:52+00:00","fetched_at":"2026-10-23T21:35:52+00:00","note":"Read ISC AA-01272 (primary). Affected/fixed versions, no workaround, PoC public per ISC. Did not search social; 2015 CVE, no PoC link found."},{"source":"nvd","external_id":"CVE-2015-5477","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5477","severity":null,"published_at":"2015-07-29T14:59:05+00:00","modified_at":"2026-10-09T19:12:37+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1120,"url":"https://kb.isc.org/docs/aa-01272","title":"ISC AA-01272: CVE-2015-5477 TKEY REQUIRE assertion failure","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}