CVE-2015-5477KEV · OVERDUECWE-617

ISC BIND Data Processing Errors Vulnerability

High · published July 29, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

11
days past CISA
deadline
CVSS v3.1
7.5
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.99409 · 99.9th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2015-07-29T18:59Z
KEV added
2026-10-08 · due 2026-10-11
Affected products (154)
ProductVersionsFixed in
juniper/junos< 12.112.1
juniper/junos≥ 13.1, < 13.213.2
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
juniper/junosall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linux_ausall versions—
redhat/enterprise_linux_ausall versions—
redhat/enterprise_linux_ausall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
oracle/vm_serverall versions—
oracle/solarisall versions—
oracle/solarisall versions—
hp/hp-uxall versions—
hp/hp-uxall versions—
hp/hp-uxall versions—
canonical/ubuntu_linuxall versions—
netapp/clustered_data_ontapall versions—
apple/os_x_serverall versions—
hpe/dnsall versions—
hpe/dnsall versions—
hp/openvmsall versions—
hpe/vcx< 9.8.189.8.18
suse/linux_enterprise_debuginfoall versions—
suse/linux_enterprise_debuginfoall versions—
opensuse/evergreenall versions—
opensuse/opensuseall versions—
opensuse/opensuseall versions—
suse/linux_enterprise_desktopall versions—
suse/linux_enterprise_desktopall versions—
suse/linux_enterprise_desktopall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_software_development_kitall versions—
suse/linux_enterprise_software_development_kitall versions—
suse/linux_enterprise_software_development_kitall versions—
isc/bind≥ 9.1.0, < 9.9.79.9.7
isc/bind≥ 9.10.0, < 9.10.29.10.2
isc/bindall versions—
References (85)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718 · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html · [email protected]http://marc.info/?l=bugtraq&m=144000632319155&w=2 · [email protected]http://marc.info/?l=bugtraq&m=144017354030745&w=2 · [email protected]http://marc.info/?l=bugtraq&m=144181171013996&w=2 · [email protected]http://marc.info/?l=bugtraq&m=144294073801304&w=2 · [email protected]http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1513.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1514.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1515.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0078.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0079.html · [email protected]http://www.debian.org/security/2015/dsa-3319 · [email protected]http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html · [email protected]http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html · [email protected]http://www.securityfocus.com/bid/76092 · [email protected]http://www.securitytracker.com/id/1033100 · [email protected]http://www.ubuntu.com/usn/USN-2693-1 · [email protected]https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415 · [email protected]https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918 · [email protected]https://kb.isc.org/article/AA-01272 · [email protected]https://kb.isc.org/article/AA-01305 · [email protected]https://kb.isc.org/article/AA-01306 · [email protected]https://kb.isc.org/article/AA-01307 · [email protected]https://kb.isc.org/article/AA-01438 · [email protected]https://kb.juniper.net/JSA10783 · [email protected]https://kc.mcafee.com/corporate/index?page=content&id=SB10126 · [email protected]https://security.gentoo.org/glsa/201510-01 · [email protected]https://security.netapp.com/advisory/ntap-20160114-0001/ · [email protected]https://support.apple.com/kb/HT205032 · [email protected]https://www.exploit-db.com/exploits/37721/ · [email protected]https://www.exploit-db.com/exploits/37723/ · [email protected]http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718 · af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html · af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html · af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=144000632319155&w=2 · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=144017354030745&w=2 · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=144181171013996&w=2 · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=144294073801304&w=2 · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1513.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1514.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1515.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0078.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0079.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3319 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/76092 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1033100 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2693-1 · af854a3a-2127-422b-91ae-364da2661108https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415 · af854a3a-2127-422b-91ae-364da2661108https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918 · af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/article/AA-01272 · af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/article/AA-01305 · af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/article/AA-01306 · af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/article/AA-01307 · af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/article/AA-01438 · af854a3a-2127-422b-91ae-364da2661108https://kb.juniper.net/JSA10783 · af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10126 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201510-01 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20160114-0001/ · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT205032 · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/37721/ · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/37723/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 00:00Z
    Added to CISA KEV — remediate by Oct 11
    kev
  • 29 JUL 14:00Z
    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon…
    cvelistv5