Resource exhaustion in ISC BIND - CVE-2021-25219

Vulnerability identifier: #VU57752

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-25219

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to BIND does not properly control consumption of internal resources when processing lame cache. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

ISC BIND
Gentoo Linux
Arch Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
IBM AIX
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
Slackware Linux
Ubuntu
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Fedora
bind (Red Hat package) main
bind9 (Debian package)
bind9 (Ubuntu package)
dhcp-debugsource
dhcp-debuginfo
dhcp-devel
dhcp
dhcp-help
bind-pkcs11
bind-utils
bind-debuginfo
bind-debugsource
bind-devel
bind-export-devel
bind-pkcs11-devel
bind-libs
bind-chroot
bind-export-libs
bind-libs-lite
bind
python3-bind
libisc1107-debuginfo-32bit
python-bind
bind-doc
libisc1107-32bit
liblwres161-debuginfo
liblwres161
libisccfg163
bind-chrootenv
bind-utils-debuginfo
libbind9-161
libbind9-161-debuginfo
libdns1110-debuginfo
libirs161
libirs161-debuginfo
libisc1107
libisc1107-debuginfo
libdns1110
libisccc161
libisccc161-debuginfo
libisccfg163-debuginfo
bind-sdb-chroot
bind-lite-devel
bind-sdb
bind-pkcs11-utils
bind-pkcs11-libs
bind-license
libirs-devel
libisccfg1600-debuginfo
libdns1605-debuginfo
libdns1605
libbind9-1600-debuginfo
libbind9-1600
libns1604-debuginfo
libns1604
libirs1601
libirs1601-debuginfo
libisc1606
libisc1606-debuginfo
libisccc1600
libisccc1600-debuginfo
libisccfg1600
bind-dyndb-ldap
net-dns/bind
net-dns/bind-tools
BIG-IP
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
OpenShift Service Mesh
OpenShift Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM VIOS
BIG-IQ
IBM Hardware Management Console
SINEC INS
IBM Integrated Analytics System

Install updates from vendor's website.

ISC BIND - addressed in versions 9.11.36, 9.11.36-S1, 9.16.22, 9.16.22-S1, 9.17.19
bind (Red Hat package) main - update to 9.11.36-3.el8
Migration Toolkit for Containers - update to 1.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
OpenShift Service Mesh - update to 2.1.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.11, 2.4.5
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.68.2, 3.69.2, 3.70
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.8
bind9 (Debian package) - addressed in versions 1:9.11.5.P4+dfsg-5.1+deb10u6, 1:9.16.22-1~deb11u1
bind9 (Ubuntu package) - addressed in versions 1:9.9.5.dfsg-3ubuntu0.19+esm5, 1:9.10.3.dfsg.P4-8ubuntu1.19+esm1, 1:9.11.3+dfsg-1ubuntu1.16, 1:9.16.1-0ubuntu2.9, 1:9.16.8-1ubuntu3.2, 1:9.16.15-1ubuntu1.1
dhcp-debugsource - update to 4.4.2-8
dhcp-debuginfo - update to 4.4.2-8
dhcp-devel - update to 4.4.2-8
dhcp - update to 4.4.2-8
dhcp-help - update to 4.4.2-8
bind-pkcs11 - update to 9.11.21-9
bind-utils - update to 9.11.21-9
bind-debuginfo - update to 9.11.21-9
bind-debugsource - update to 9.11.21-9
bind-devel - update to 9.11.21-9
bind-export-devel - update to 9.11.21-9
bind-pkcs11-devel - update to 9.11.21-9
bind-libs - update to 9.11.21-9
bind-chroot - update to 9.11.21-9
bind-export-libs - update to 9.11.21-9
bind-libs-lite - update to 9.11.21-9
bind - update to 9.11.21-9
python3-bind - update to 9.11.21-9
libisc1107-debuginfo-32bit - update to 9.11.22-3.37.1
python-bind - update to 9.11.22-3.37.1
bind-doc - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
libisc1107-32bit - update to 9.11.22-3.37.1
liblwres161-debuginfo - update to 9.11.22-3.37.1
liblwres161 - update to 9.11.22-3.37.1
libisccfg163 - update to 9.11.22-3.37.1
bind-debuginfo - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind-debugsource - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind-devel - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1
bind - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind-chrootenv - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1
bind-utils - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
bind-utils-debuginfo - addressed in versions 9.11.22-3.37.1, 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
libbind9-161 - update to 9.11.22-3.37.1
libbind9-161-debuginfo - update to 9.11.22-3.37.1
libdns1110-debuginfo - update to 9.11.22-3.37.1
libirs161 - update to 9.11.22-3.37.1
libirs161-debuginfo - update to 9.11.22-3.37.1
libisc1107 - update to 9.11.22-3.37.1
libisc1107-debuginfo - update to 9.11.22-3.37.1
libdns1110 - update to 9.11.22-3.37.1
libisccc161 - update to 9.11.22-3.37.1
libisccc161-debuginfo - update to 9.11.22-3.37.1
libisccfg163-debuginfo - update to 9.11.22-3.37.1
bind - addressed in versions 9.11.36-1.fc33, 9.16.22-1.fc34, 9.16.22-1.fc35
bind-utils - update to 9.11.36-3
bind-sdb-chroot - update to 9.11.36-3
bind-pkcs11-devel - update to 9.11.36-3
bind-pkcs11 - update to 9.11.36-3
bind-lite-devel - update to 9.11.36-3
bind-libs - update to 9.11.36-3
bind-export-libs - update to 9.11.36-3
bind-export-devel - update to 9.11.36-3
bind-devel - update to 9.11.36-3
bind-chroot - update to 9.11.36-3
bind - update to 9.11.36-3
bind-libs-lite - update to 9.11.36-3
python3-bind - update to 9.11.36-3
bind-sdb - update to 9.11.36-3
bind-pkcs11-utils - update to 9.11.36-3
bind-pkcs11-libs - update to 9.11.36-3
bind-license - update to 9.11.36-3
libirs-devel - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccfg1600-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libdns1605-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libdns1605 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libbind9-1600-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libbind9-1600 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libns1604-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
python3-bind - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1, 9.16.31-150400.5.6.1
libns1604 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libirs1601 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libirs1601-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisc1606 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisc1606-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccc1600 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccc1600-debuginfo - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
libisccfg1600 - addressed in versions 9.16.6-12.57.1, 9.16.6-150300.22.13.1
bind-dyndb-ldap - addressed in versions 11.9-6.fc34, 11.9-8.fc35
SINEC INS - update to 1.0.1.1
IBM Integrated Analytics System - update to 1.0.30.0
OpenShift Virtualization - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0
IBM Hardware Management Console - addressed in versions 9.2.950.0 SP3 x86, 9.2.950.0 SP3 ppc, 10.1.1020.0 SP1 x86, 10.1.1020.0 SP1 ppc
net-dns/bind - update to 9.16.33
net-dns/bind-tools - update to 9.16.33
bind - update to 9.16.22-1

• https://kb.isc.org/v1/docs/cve-2021-25219

• Denial of service ISC BIND
• Slackware Linux update for bind
• Debian update for bind9
• Denial of service in F5 BIG-IP BIND
• IBM AIX update for bind
• IBM VIOS update for bind
• Multiple vulnerabilities in Siemens SINEC INS
• Red Hat Enterprise Linux 8 update for bind
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.1
• SUSE update for bind
• SUSE update for bind
• Ubuntu update for bind9
• Ubuntu update for bind9
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• SUSE update for bind
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in OpenShift Virtualization
• Gentoo update for ISC BIND
• Resource exhaustion in IBM Hardware Management Console
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for bind
• Arch Linux update for bind
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• openEuler update for bind
• openEuler update for dhcp
• IBM Integrated Analytics System update for BIND
• Fedora 34 update for bind, bind-dyndb-ldap
• Fedora 35 update for bind, bind-dyndb-ldap
• Fedora 33 update for bind
• Anolis OS update for bind (Anolis OS 8.6)