Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-25219

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Published

2021-10-27T21:15:07.613

Last Modified

2024-11-21T05:54:34.323

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application isc bind < 9.11.36 Yes
Application isc bind < 9.16.22 Yes
Application isc bind < 9.17.19 Yes
Application isc bind 9.9.3 Yes
Application isc bind 9.9.12 Yes
Application isc bind 9.9.13 Yes
Application isc bind 9.10.5 Yes
Application isc bind 9.10.7 Yes
Application isc bind 9.11.3 Yes
Application isc bind 9.11.5 Yes
Application isc bind 9.11.5 Yes
Application isc bind 9.11.5 Yes
Application isc bind 9.11.6 Yes
Application isc bind 9.11.7 Yes
Application isc bind 9.11.8 Yes
Application isc bind 9.11.12 Yes
Application isc bind 9.11.21 Yes
Application isc bind 9.11.27 Yes
Application isc bind 9.11.29 Yes
Application isc bind 9.11.35 Yes
Application isc bind 9.16.8 Yes
Application isc bind 9.16.11 Yes
Application isc bind 9.16.13 Yes
Application isc bind 9.16.21 Yes
Operating System debian debian_linux 9.0 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
Operating System fedoraproject fedora 33 Yes
Operating System fedoraproject fedora 34 Yes
Operating System fedoraproject fedora 35 Yes
Operating System netapp h300s_firmware - Yes
Hardware netapp h300s - No
Operating System netapp h500s_firmware - Yes
Hardware netapp h500s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System netapp h300e_firmware - Yes
Hardware netapp h300e - No
Operating System netapp h500e_firmware - Yes
Hardware netapp h500e - No
Operating System netapp h700e_firmware - Yes
Hardware netapp h700e - No
Operating System netapp h410s_firmware - Yes
Hardware netapp h410s - No
Operating System netapp h410c_firmware - Yes
Hardware netapp h410c - No
Application netapp cloud_backup - Yes
Application siemens sinec_infrastructure_network_services < 1.0.1.1 Yes
Application oracle http_server 12.2.1.3.0 Yes
Application oracle http_server 12.2.1.4.0 Yes
Application oracle zfs_storage_appliance_kit 8.8 Yes
References