Reachable Assertion in ISC BIND - CVE-2021-25214

Vulnerability identifier: #VU52734

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-25214

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when pressing IXFR queries. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the next SOA refresh query for that zone is made. When a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

ISC BIND
Arch Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux Server
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Red Hat Enterprise Linux for ARM 64
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Server Applications
openEuler
Fedora
BIG-IP
IBM Integrated Analytics System
Cloud Pak for Security (CP4S)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
BIG-IQ
IBM Hardware Management Console
bind9 (Debian package)
bind9 (Ubuntu package)
dnsperf
dhcp
dhcp-devel
dhcp-debuginfo
dhcp-debugsource
dhcp-help
bind-libs-32bit
bind-debugsource
bind-debuginfo
bind-devel
bind-utils
bind-libs
bind-doc
bind-chrootenv
bind
bind-libs-debuginfo-32bit
bind-utils-debuginfo
bind-libs-debuginfo
bind-pkcs11-utils
bind-sdb
bind-sdb-chroot
bind-license
bind-chroot
bind-export-devel
bind-export-libs
bind-libs-lite
bind-lite-devel
bind-pkcs11
bind-pkcs11-devel
bind-pkcs11-libs
bind (Red Hat package) main
python3-bind
libirs161
libdns1110-debuginfo
libisccc161-debuginfo
libirs161-debuginfo
libisc1107-32bit
libisc1107
libisc1107-debuginfo-32bit
libisc1107-debuginfo
libisccc161
python-bind
liblwres161-debuginfo
liblwres161
libisccfg163-debuginfo
libisccfg163
libbind9-161-debuginfo
libbind9-161
libdns1110
libdns1605-debuginfo
libisccc1600
libns1604-debuginfo
libns1604
libisccfg1600-debuginfo
libisccfg1600
libisccc1600-debuginfo
libisc1606-debuginfo
libisc1606
libirs1601-debuginfo
libirs1601
libdns1605
libirs-devel
libbind9-1600
libbind9-1600-debuginfo
bind-dyndb-ldap
SINEC INS
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)

Install updates from vendor's website.

ISC BIND - addressed in versions 9.11.31, 9.11.31-S1, 9.16.15, 9.16.15-S1, 9.17.12
Cloud Pak for Security (CP4S) - update to 1.8.0.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.8
bind9 (Debian package) - update to 1:9.11.5.P4+dfsg-5.1+deb10u5
bind9 (Ubuntu package) - addressed in versions 1:9.9.5.dfsg-3ubuntu0.19+esm13, 1:9.10.3.dfsg.P4-8ubuntu1.19, 1:9.11.3+dfsg-1ubuntu1.15, 1:9.16.1-0ubuntu2.8, 1:9.16.6-3ubuntu1.2, 1:9.16.8-1ubuntu3.1
dnsperf - update to 2.3.4-6.fc32
dhcp - update to 4.4.2-8
dhcp-devel - update to 4.4.2-8
dhcp-debuginfo - update to 4.4.2-8
dhcp-debugsource - update to 4.4.2-8
dhcp-help - update to 4.4.2-8
bind-libs-32bit - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1
bind-debugsource - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-debuginfo - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-devel - addressed in versions 9.9.6P1-0.51.26.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-utils - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-libs - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1
bind-doc - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-chrootenv - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind - addressed in versions 9.9.6P1-0.51.26.1, 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-libs-debuginfo-32bit - update to 9.9.9P1-63.25.1
bind-utils-debuginfo - addressed in versions 9.9.9P1-63.25.1, 9.11.22-3.34.1, 9.16.6-12.49.1, 9.16.6-22.7.1
bind-libs-debuginfo - update to 9.9.9P1-63.25.1
bind-pkcs11-utils - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-sdb - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-sdb-chroot - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-utils - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-license - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-chroot - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-devel - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-export-devel - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-export-libs - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-libs - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-libs-lite - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-lite-devel - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-pkcs11 - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-pkcs11-devel - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind-pkcs11-libs - addressed in versions 9.11.4-26.P2, 9.11.26-4
bind (Red Hat package) main - addressed in versions 9.11.4-26.P2.el7_9.7, 9.11.26-6.el8
python3-bind - update to 9.11.21-6
bind-export-devel - update to 9.11.21-6
bind-export-libs - update to 9.11.21-6
bind-libs - update to 9.11.21-6
bind-libs-lite - update to 9.11.21-6
bind-pkcs11-devel - update to 9.11.21-6
bind-utils - update to 9.11.21-6
bind-devel - update to 9.11.21-6
bind-pkcs11 - update to 9.11.21-6
bind-chroot - update to 9.11.21-6
bind-debuginfo - update to 9.11.21-6
bind-debugsource - update to 9.11.21-6
bind - update to 9.11.21-6
libirs161 - update to 9.11.22-3.34.1
libdns1110-debuginfo - update to 9.11.22-3.34.1
libisccc161-debuginfo - update to 9.11.22-3.34.1
libirs161-debuginfo - update to 9.11.22-3.34.1
libisc1107-32bit - update to 9.11.22-3.34.1
libisc1107 - update to 9.11.22-3.34.1
libisc1107-debuginfo-32bit - update to 9.11.22-3.34.1
libisc1107-debuginfo - update to 9.11.22-3.34.1
libisccc161 - update to 9.11.22-3.34.1
python-bind - update to 9.11.22-3.34.1
liblwres161-debuginfo - update to 9.11.22-3.34.1
liblwres161 - update to 9.11.22-3.34.1
libisccfg163-debuginfo - update to 9.11.22-3.34.1
libisccfg163 - update to 9.11.22-3.34.1
libbind9-161-debuginfo - update to 9.11.22-3.34.1
libbind9-161 - update to 9.11.22-3.34.1
libdns1110 - update to 9.11.22-3.34.1
python3-bind - update to 9.11.26-4
bind - addressed in versions 9.11.31-1.fc32, 9.11.31-1.fc33, 9.16.15-1.fc34
libdns1605-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libisccc1600 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
python3-bind - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libns1604-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libns1604 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libisccfg1600-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libisccfg1600 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libisccc1600-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libisc1606-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libisc1606 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libirs1601-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libirs1601 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libdns1605 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libirs-devel - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libbind9-1600 - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
libbind9-1600-debuginfo - addressed in versions 9.16.6-12.49.1, 9.16.6-22.7.1
bind-dyndb-ldap - addressed in versions 11.3-6.fc32, 11.3-7.fc33, 11.7-3.fc34
SINEC INS - update to 1.0.1.1
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
IBM Hardware Management Console - addressed in versions 9.2.952.0, 10.1.1010.0 x86, 10.1.1010.0 ppc

• https://kb.isc.org/v1/docs/cve-2021-25214
• http://www.openwall.com/lists/oss-security/2021/04/29/1

• Multiple vulnerabilities in ISC BIND
• Slackware Linux update for bind
• Arch Linux update for bind
• Debian update for bind9
• Denial of service in F5 BIG-IP BIND
• Red Hat Enterprise Linux 7 update for bind
• CentOS 7 update for bind
• Multiple vulnerabilities in Dell EMC Unity
• Multiple vulnerabilities in IBM Integrated Analytics System
• Multiple vulnerabilities in Siemens SINEC INS
• Denial of service in IBM Power HMC
• SUSE update for bind
• SUSE update for bind
• SUSE update for bind
• Ubuntu update for bind9
• Multiple vulnerabilities in IBM Cloud Pak for Security
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for ISC BIND
• Red Hat Enterprise Linux 8 update for bind
• SUSE update for bind
• SUSE update for bind
• openEuler 20.03 LTS SP1 update for bind
• openEuler update for dhcp
• Fedora 34 update for bind, bind-dyndb-ldap
• Fedora 33 update for bind, bind-dyndb-ldap
• Fedora 32 update for bind, bind-dyndb-ldap, dnsperf
• Anolis OS update for bind (Anolis OS 8.4)
• Anolis OS update for bind
• Ubuntu update for bind9