QID 15149

Date Published: 2023-07-25

QID 15149: ISC BIND Denial of Service (DoS) Vulnerability (CVE-2015-1349)

ISC BIND (Berkley Internet Domain Name) is an implementation of DNS protocols.

BIND servers which are configured to perform DNSSEC validation and which are using managed-keys (which occurs implicitly when using "dnssec-validation auto;" or "dnssec-lookaside auto;") may terminate with an assertion failure when encountering all of the following conditions in a managed trust anchor: a key which was previously trusted is now flagged as revoked; there are no other trusted keys available; there is a standby key, but it is not trusted yet.

BIND Affected versions:
9.7.0 - 9.10.1-P1
9.9.7b1 and 9.9.7rc1
9.10.2b1 and rc1
9.9.6, 9.9.6-P1, 9.10.1, and 9.10.1-P1
QID Detection Logic:
This unauthenticated check detects vulnerable systems by fetching the version information from the BIND service.

Servers which are affected may terminate with an assertion, causing denial of service to all clients.

CVSS V3 rated as Medium - 5.9 severity.

CVSS V2 rated as Medium - 5.4 severity.

Solution

Customers are advised to upgrade latest release of ISC BIND.
Workaround:
For a workaround, do not use "auto" for the dnssec-validation or dnssec-lookaside options and do not configure a managed-keys statement. In order to do DNSSEC validation with this workaround, one would have to configure an explicit trusted-keys statement with the appropriate keys.

Vendor References

CVE-2015-1349 - kb.isc.org/docs/aa-01235

CVEs related to QID 15149

CVE-2015-1349 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2015-1349			kb.isc.org/docs/aa-01235

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].