ISC Vulnerabilities and Affected Products

Products

BIND 969 vulnerabilities
BIND923 vulnerabilities
bind14 vulnerabilities
Kea9 vulnerabilities
ISC DHCP6 vulnerabilities
BIND 9 Supported Preview Edition2 vulnerabilities
Stork2 vulnerabilities
bind_91 vulnerability
inn1 vulnerability
Kea DHCP1 vulnerability

ISC vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-4076HIGH	Assertion failure when serving both stale cache data and authoritative zone content Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. CWE-617Jul 23, 2024	CVSS7.5v3.1	EPSS2.11%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1975HIGH	SIG(0) can be used to exhaust CPU resources If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1. CWE-770Jul 23, 2024	CVSS7.5v3.1	EPSS2.11%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1737HIGH	BIND's database will be slow if a very large number of RRs exist at the same name Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. CWE-770Jul 23, 2024	CVSS7.5v3.1	EPSS2.11%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-0760HIGH	A flood of DNS messages over TCP may make the server unstable A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1. CWE-770Jul 23, 2024	CVSS7.5v3.1	EPSS4.68%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-6516HIGH	Specific recursive query patterns may lead to an out-of-memory condition To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanu… CWE-770 CWE-789Feb 13, 2024	CVSS7.5v3.1	EPSS1.11%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-3080HIGH	BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly By sending specific queries to the resolver, an attacker can cause named to crash. CWE-613 CWE-74Sep 21, 2022	CVSS7.5v3.1	EPSS1.63%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-2795MEDIUM	Processing large delegations may severely degrade resolver performance By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CWE-400Sep 21, 2022	CVSS5.3v3.1	EPSS1.72%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-25220MEDIUM	DNS forwarders - cache poisoning vulnerability BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. CWE-444Mar 23, 2022	CVSS6.8v3.1	EPSS3.36%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-0635HIGH	Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. CWE-617Mar 23, 2022	CVSS7.5v3.1	EPSS1.35%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-0396MEDIUM	DoS from specifically crafted TCP packets BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. CWE-404Mar 23, 2022	CVSS5.3v3.1	EPSS2.7%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-0667HIGH	Assertion failure on delayed DS lookup When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 CWE-617Mar 22, 2022	CVSS7.5v3.1	EPSS1.35%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2015-5477	ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 TKEY Queries Denial of Service named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. CWE-19Jul 29, 2015	CVSS7.8v2.0	EPSS91.3%	PoCs9	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2013-4854	ISC BIND RFC 5011 Implementation in rdata.c Denial of Service The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. Jul 26, 2013	CVSS7.8v2.0	EPSS34.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2009-0696	ISC BIND dns_db_findrdataset Function Denial of Service The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message. CWE-16Jul 29, 2009	CVSS4.3v2.0	EPSS12.6%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX