CVE-2021-25215
Last modified
CVE-2021-25215 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.. EPSS estimates a 11.30% chance of exploitation in the next 30 days.
Description
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Debian | Debian Linux | 9.0 | — |
| Debian | Debian Linux | 10.0 | — |
| Isc | Bind | >= 9.0.0, < 9.11.31 | — |
| Isc | Bind | >= 9.12.0, < 9.16.15 | — |
| Isc | Bind | >= 9.17.0, < 9.17.12 | — |
| Isc | Bind | 9.9.3 | S1 |
| Isc | Bind | 9.9.12 | S1 |
| Isc | Bind | 9.9.13 | S1 |
| Isc | Bind | 9.10.5 | S1 |
| Isc | Bind | 9.10.7 | S1 |
| Isc | Bind | 9.11.3 | S1 |
| Isc | Bind | 9.11.5 | S3 |
| Isc | Bind | 9.11.6 | S1 |
| Isc | Bind | 9.11.7 | S1 |
| Isc | Bind | 9.11.8 | S1 |
| Isc | Bind | 9.11.12 | S1 |
| Isc | Bind | 9.11.21 | S1 |
| Isc | Bind | 9.11.27 | S1 |
| Isc | Bind | 9.11.29 | S1 |
| Isc | Bind | 9.16.8 | S1 |
| Isc | Bind | 9.16.11 | S1 |
| Isc | Bind | 9.16.13 | S1 |
| Fedoraproject | Fedora | 33 | — |
| Fedoraproject | Fedora | 34 | — |
| Netapp | Active Iq Unified Manager | All versions | — |
| Netapp | Cloud Backup | All versions | — |
| Netapp | H300s Firmware | All versions | — |
| Netapp | H500s Firmware | All versions | — |
| Netapp | H700s Firmware | All versions | — |
| Netapp | H300e Firmware | All versions | — |
| Netapp | H500e Firmware | All versions | — |
| Netapp | H700e Firmware | All versions | — |
| Netapp | H410s Firmware | All versions | — |
| Netapp | A250 Firmware | All versions | — |
| Netapp | 500f Firmware | All versions | — |
| Oracle | Tekelec Platform Distribution | >= 7.4.0, <= 7.7.1 | — |
| Siemens | Sinec Infrastructure Network Services | < 1.0.1.1 | — |
References
- http://www.openwall.com/lists/oss-security/2021/04/29/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/4Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
- https://kb.isc.org/v1/docs/cve-2021-25215Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00001.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210521-0006/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4909Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/4Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
- https://kb.isc.org/v1/docs/cve-2021-25215Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00001.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210521-0006/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4909Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-25215?
How severe is CVE-2021-25215?
How do I fix CVE-2021-25215?
Are you affected by CVE-2021-25215?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
