Input validation error in ISC BIND - CVE-2015-5986
Published: September 5, 2015 / Updated: July 28, 2020
Vulnerability identifier: #VU32396
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-5986
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.
Affected software
ISC BIND
Amazon Linux AMI
Gentoo Linux
Slackware Linux
Fedora
bind (Alpine package)
bind99
Amazon Linux AMI
Gentoo Linux
Slackware Linux
Fedora
bind (Alpine package)
bind99
How to mitigate CVE-2015-5986
Install update from vendor's website.
ISC BIND - update to 9.9.7-P3
bind (Alpine package) - update to 9.9.7_p3-r0
bind99 - addressed in versions 9.9.7-7.P3.fc22, 9.9.7-7.P3.fc23
bind (Alpine package) - update to 9.9.7_p3-r0
bind99 - addressed in versions 9.9.7-7.P3.fc22, 9.9.7-7.P3.fc23
External References
- http://lists.apple.com/archives/security-announce/2015/Oct/msg00009.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165810.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167465.html
- http://www.securityfocus.com/bid/76618
- http://www.securitytracker.com/id/1033453
- https://kb.isc.org/article/AA-01291
- https://kb.isc.org/article/AA-01305
- https://kb.isc.org/article/AA-01306
- https://kb.isc.org/article/AA-01307
- https://kb.isc.org/article/AA-01438
- https://kc.mcafee.com/corporate/index?page=content&id=SB10134
- https://security.gentoo.org/glsa/201510-01
- https://security.netapp.com/advisory/ntap-20190730-0001/
- https://support.apple.com/HT205376