Resource exhaustion in ISC BIND - CVE-2021-25219

Vulnerability identifier: #VU57752

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-25219

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to BIND does not properly control consumption of internal resources when processing lame cache. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

ISC BIND
Arch Linux
Gentoo Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
IBM AIX
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
Slackware Linux
Ubuntu
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
openEuler
Fedora
BIG-IP
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
OpenShift Service Mesh
OpenShift Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM VIOS
BIG-IQ Centralized Management
IBM Hardware Management Console
bind (Red Hat package) main
bind9 (Debian package)
dhcp-debugsource
dhcp-debuginfo
dhcp-devel
dhcp
dhcp-help
bind9 (Ubuntu package)
bind-pkcs11
python3-bind
bind-utils
bind-debuginfo
bind-debugsource
bind-devel
bind-export-devel
bind-pkcs11-devel
bind-libs
bind-chroot
bind-export-libs
bind
bind-libs-lite
libisc1107-debuginfo
bind-utils-debuginfo
libisccfg163
libbind9-161
bind-chrootenv
libisccc161-debuginfo
libisccc161
libisc1107
libirs161-debuginfo
libbind9-161-debuginfo
libdns1110
libdns1110-debuginfo
libirs161
liblwres161
liblwres161-debuginfo
libisc1107-32bit
libisc1107-debuginfo-32bit
bind-doc
python-bind
libisccfg163-debuginfo
bind-sdb-chroot
bind-license
bind-sdb
bind-pkcs11-utils
bind-pkcs11-libs
bind-lite-devel
libisccfg1600-debuginfo
libbind9-1600
libbind9-1600-debuginfo
libns1604-debuginfo
libns1604
libisccfg1600
libisccc1600-debuginfo
libdns1605
libdns1605-debuginfo
libisccc1600
libisc1606-debuginfo
libisc1606
libirs1601-debuginfo
libirs1601
libirs-devel
net-dns/bind
net-dns/bind-tools
bind-dyndb-ldap
SINEC INS
IBM Integrated Analytics System

Install updates from vendor's website.

ISC BIND - addressed in versions 9.11.36, 9.11.36-S1, 9.16.22, 9.16.22-S1, 9.17.19
Migration Toolkit for Containers - update to 1.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
OpenShift Service Mesh - update to 2.1.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.11, 2.4.5
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.68.2, 3.69.2, 3.70
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.8
bind (Red Hat package) main - update to 9.11.36-3.el8
bind9 (Debian package) - addressed in versions 1:9.11.5.P4+dfsg-5.1+deb10u6, 1:9.16.22-1~deb11u1
SINEC INS - update to 1.0.1.1
IBM Integrated Analytics System - update to 1.0.30.0
dhcp-debugsource - update to 4.4.2-8
dhcp-debuginfo - update to 4.4.2-8
dhcp-devel - update to 4.4.2-8
dhcp - update to 4.4.2-8
dhcp-help - update to 4.4.2-8
OpenShift Virtualization - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0
IBM Hardware Management Console - addressed in versions 9.2.950.0 SP3 ppc, 9.2.950.0 SP3 x86, 10.1.1020.0 SP1 ppc, 10.1.1020.0 SP1 x86
bind9 (Ubuntu package) - addressed in versions 1:9.10.3.dfsg.P48ubuntu1.19+esm1, 1:9.11.3+dfsg-1ubuntu1.16, 1:9.16.1-0ubuntu2.9, 1:9.16.8-1ubuntu3.2, 1:9.16.15-1ubuntu1.1
bind-pkcs11 - update to 9.11.21-9
python3-bind - update to 9.11.21-9
bind-utils - update to 9.11.21-9
bind-debuginfo - update to 9.11.21-9
bind-debugsource - update to 9.11.21-9
bind-devel - update to 9.11.21-9
bind-export-devel - update to 9.11.21-9
bind-pkcs11-devel - update to 9.11.21-9
bind-libs - update to 9.11.21-9
bind-chroot - update to 9.11.21-9
bind-export-libs - update to 9.11.21-9
bind - update to 9.11.21-9
bind-libs-lite - update to 9.11.21-9
libisc1107-debuginfo - update to 9.11.22-3.37.1
bind-utils - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind-utils-debuginfo - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
libisccfg163 - update to 9.11.22-3.37.1
libbind9-161 - update to 9.11.22-3.37.1
bind-chrootenv - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccc161-debuginfo - update to 9.11.22-3.37.1
libisccc161 - update to 9.11.22-3.37.1
libisc1107 - update to 9.11.22-3.37.1
libirs161-debuginfo - update to 9.11.22-3.37.1
libbind9-161-debuginfo - update to 9.11.22-3.37.1
libdns1110 - update to 9.11.22-3.37.1
bind - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
libdns1110-debuginfo - update to 9.11.22-3.37.1
libirs161 - update to 9.11.22-3.37.1
bind-devel - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1
liblwres161 - update to 9.11.22-3.37.1
liblwres161-debuginfo - update to 9.11.22-3.37.1
libisc1107-32bit - update to 9.11.22-3.37.1
libisc1107-debuginfo-32bit - update to 9.11.22-3.37.1
bind-doc - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
python-bind - update to 9.11.22-3.37.1
libisccfg163-debuginfo - update to 9.11.22-3.37.1
bind-debugsource - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind-debuginfo - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind - addressed in versions 9.11.36-1.fc33, 9.16.22-1.fc34, 9.16.22-1.fc35
bind-sdb-chroot - update to 9.11.36-3
python3-bind - update to 9.11.36-3
bind - update to 9.11.36-3
bind-chroot - update to 9.11.36-3
bind-devel - update to 9.11.36-3
bind-license - update to 9.11.36-3
bind-utils - update to 9.11.36-3
bind-export-devel - update to 9.11.36-3
bind-sdb - update to 9.11.36-3
bind-pkcs11-utils - update to 9.11.36-3
bind-pkcs11-libs - update to 9.11.36-3
bind-pkcs11-devel - update to 9.11.36-3
bind-pkcs11 - update to 9.11.36-3
bind-lite-devel - update to 9.11.36-3
bind-libs-lite - update to 9.11.36-3
bind-libs - update to 9.11.36-3
bind-export-libs - update to 9.11.36-3
libisccfg1600-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libbind9-1600 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libbind9-1600-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
python3-bind - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
libns1604-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libns1604 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccfg1600 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccc1600-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libdns1605 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libdns1605-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccc1600 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisc1606-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisc1606 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libirs1601-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libirs1601 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libirs-devel - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
bind - update to 9.16.22-1
net-dns/bind - update to 9.16.33
net-dns/bind-tools - update to 9.16.33
bind-dyndb-ldap - addressed in versions 11.9-6.fc34, 11.9-8.fc35

• https://kb.isc.org/v1/docs/cve-2021-25219

• Denial of service ISC BIND
• Slackware Linux update for bind
• Debian update for bind9
• Denial of service in F5 BIG-IP BIND
• IBM AIX update for bind
• IBM VIOS update for bind
• Multiple vulnerabilities in Siemens SINEC INS
• Red Hat Enterprise Linux 8 update for bind
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.1
• SUSE update for bind
• SUSE update for bind
• Ubuntu update for bind9
• Ubuntu update for bind9
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• SUSE update for bind
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in OpenShift Virtualization
• Gentoo update for ISC BIND
• Resource exhaustion in IBM Hardware Management Console
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for bind
• Arch Linux update for bind
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• openEuler update for bind
• openEuler update for dhcp
• IBM Integrated Analytics System update for BIND
• Fedora 34 update for bind, bind-dyndb-ldap
• Fedora 35 update for bind, bind-dyndb-ldap
• Fedora 33 update for bind
• Anolis OS update for bind (Anolis OS 8.6)