CVE-2021-25215 An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
HighCVSS 7.5
EPSS 11.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bind9(Debian:12) | < 1:9.16.15-1 | 1:9.16.15-1 |
| debian/bind9(Debian:13) | < 1:9.16.15-1 | 1:9.16.15-1 |
| debian/bind9(Debian:14) | < 1:9.16.15-1 | 1:9.16.15-1 |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| isc bind | >= 9.0.0, < 9.11.31 | 9.11.31 |
| isc bind | >= 9.12.0, < 9.16.15 | 9.16.15 |
| isc bind | >= 9.17.0, < 9.17.12 | 9.17.12 |
| isc bind | = 9.9.3-s1 | No fix listed |
| isc bind | = 9.9.12-s1 | No fix listed |
| isc bind | = 9.9.13-s1 | No fix listed |
| isc bind | = 9.10.5-s1 | No fix listed |
| isc bind | = 9.10.7-s1 | No fix listed |
| isc bind | = 9.11.3-s1 | No fix listed |
| isc bind | = 9.11.5-s3 | No fix listed |
| isc bind | = 9.11.5-s5 | No fix listed |
| isc bind | = 9.11.5-s6 | No fix listed |
| isc bind | = 9.11.6-s1 | No fix listed |
| isc bind | = 9.11.7-s1 | No fix listed |
| isc bind | = 9.11.8-s1 | No fix listed |
| isc bind | = 9.11.12-s1 | No fix listed |
| isc bind | = 9.11.21-s1 | No fix listed |
| isc bind | = 9.11.27-s1 | No fix listed |
| isc bind | = 9.11.29-s1 | No fix listed |
| isc bind | = 9.16.8-s1 | No fix listed |
Show 37 more
| Product | Affected versions | Fixed in |
|---|---|---|
| isc bind | = 9.16.11-s1 | No fix listed |
| isc bind | = 9.16.13-s1 | No fix listed |
| fedoraproject fedora | = 33 | No fix listed |
| fedoraproject fedora | = 34 | No fix listed |
| netapp active iq unified manager | All versions | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp h300s firmware | All versions | No fix listed |
| netapp h500s firmware | All versions | No fix listed |
| netapp h700s firmware | All versions | No fix listed |
| netapp h300e firmware | All versions | No fix listed |
| netapp h500e firmware | All versions | No fix listed |
| netapp h700e firmware | All versions | No fix listed |
| netapp h410s firmware | All versions | No fix listed |
| netapp a250 firmware | All versions | No fix listed |
| netapp 500f firmware | All versions | No fix listed |
| oracle tekelec platform distribution | >= 7.4.0, <= 7.7.1 | No fix listed |
| Siemens sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
| alpine/bind(Alpine:v3.10) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.11) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.12) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.13) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.14) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.15) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.16) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.17) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.18) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.19) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.20) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.21) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.22) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.23) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| alpine/bind(Alpine:v3.24) | >= 9.0.0, < 9.16.15-r0 | 9.16.15-r0 |
| isc BIND9 | = Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30 | No fix listed |
| isc BIND9 | = Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14 | No fix listed |
| isc BIND9 | = Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1 | No fix listed |
| isc BIND9 | = Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1 | No fix listed |
| isc BIND9 | = Development Branch 9.17 9.17.0 through versiosn before 9.17.12 | No fix listed |
References
- Debian Security Tracker CVE-2021-25215 vendor-advisory
- [oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list third-party-advisory
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list third-party-advisory
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list third-party-advisory
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list third-party-advisory
- cert-portal.siemens.com patch third-party-advisory
- kb.isc.org vendor-advisory
- [debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update mailing-list third-party-advisory
- FEDORA-2021-ace61cbee1 vendor-advisory
- FEDORA-2021-47f23870ec vendor-advisory
- security.netapp.com third-party-advisory
- DSA-4909 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking