Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-25214

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

Published

2021-04-29T01:15:07.977

Last Modified

2024-11-21T05:54:33.470

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-617

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	isc	bind	≤ 9.8.8	Yes
Application	isc	bind	< 9.11.31	Yes
Application	isc	bind	< 9.16.15	Yes
Application	isc	bind	< 9.17.12	Yes
Application	isc	bind	9.9.3	Yes
Application	isc	bind	9.9.12	Yes
Application	isc	bind	9.9.13	Yes
Application	isc	bind	9.10.5	Yes
Application	isc	bind	9.10.7	Yes
Application	isc	bind	9.11.3	Yes
Application	isc	bind	9.11.5	Yes
Application	isc	bind	9.11.5	Yes
Application	isc	bind	9.11.5	Yes
Application	isc	bind	9.11.6	Yes
Application	isc	bind	9.11.7	Yes
Application	isc	bind	9.11.8	Yes
Application	isc	bind	9.11.12	Yes
Application	isc	bind	9.11.21	Yes
Application	isc	bind	9.11.27	Yes
Application	isc	bind	9.11.29	Yes
Application	isc	bind	9.16.8	Yes
Application	isc	bind	9.16.11	Yes
Application	isc	bind	9.16.13	Yes
Operating System	debian	debian_linux	9.0	Yes
Operating System	debian	debian_linux	10.0	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	fedoraproject	fedora	34	Yes
Application	siemens	sinec_infrastructure_network_services	< 1.0.1.1	Yes
Application	netapp	active_iq_unified_manager	-	Yes
Application	netapp	cloud_backup	-	Yes
Operating System	netapp	aff_a250_firmware	-	Yes
Hardware	netapp	aff_a250	-	No
Operating System	netapp	aff_500f_firmware	-	Yes
Hardware	netapp	aff_500f	-	No
Operating System	netapp	h300s_firmware	-	Yes
Hardware	netapp	h300s	-	No
Operating System	netapp	h500s_firmware	-	Yes
Hardware	netapp	h500s	-	No
Operating System	netapp	h700s_firmware	-	Yes
Hardware	netapp	h700s	-	No
Operating System	netapp	h300e_firmware	-	Yes
Hardware	netapp	h300e	-	No
Operating System	netapp	h500e_firmware	-	Yes
Hardware	netapp	h500e	-	No
Operating System	netapp	h700e_firmware	-	Yes
Hardware	netapp	h700e	-	No
Operating System	netapp	h410s_firmware	-	Yes
Hardware	netapp	h410s	-	No

References

http://www.openwall.com/lists/oss-security/2021/04/29/1 Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/04/29/2 Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/04/29/3 Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/04/29/4 Mailing List, Third Party Advisory ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory ([email protected])
https://kb.isc.org/v1/docs/cve-2021-25214 Vendor Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html Mailing List, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/ ([email protected])
https://security.netapp.com/advisory/ntap-20210521-0006/ Third Party Advisory ([email protected])
https://www.debian.org/security/2021/dsa-4909 Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/04/29/1 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2021/04/29/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2021/04/29/3 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2021/04/29/4 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.isc.org/v1/docs/cve-2021-25214 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20210521-0006/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2021/dsa-4909 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)