{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.110Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/v1/docs/cve-2021-25215",
               },
               {
                  name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
               },
               {
                  name: "DSA-4909",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4909",
               },
               {
                  name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
               },
               {
                  name: "FEDORA-2021-ace61cbee1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/",
               },
               {
                  name: "FEDORA-2021-47f23870ec",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1",
                  },
                  {
                     status: "affected",
                     version: "Development Branch 9.17 9.17.0 through versiosn before 9.17.12",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Siva Kakarla for bringing this vulnerability to our attention.",
            },
         ],
         datePublic: "2021-04-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "DNAME records, described in RFC 6672, provide a way to redirect a subtree of the domain name tree in the DNS. A flaw in the way named processes these records may trigger an attempt to add the same RRset to the ANSWER section more than once. This causes an assertion check in BIND to fail.  DNAME records are processed by both authoritative and recursive servers. For authoritative servers, the DNAME record triggering the flaw can be retrieved from a zone database. For servers performing recursion, such a record is processed in the course of a query sent to an authoritative server.  Affects BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-08T14:08:28",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kb.isc.org/v1/docs/cve-2021-25215",
            },
            {
               name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
            },
            {
               name: "DSA-4909",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4909",
            },
            {
               name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
            },
            {
               name: "FEDORA-2021-ace61cbee1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/",
            },
            {
               name: "FEDORA-2021-47f23870ec",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND:\n\n    BIND 9.11.31\n    BIND 9.16.15\n    BIND 9.17.12\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9.11.31-S1\n    BIND 9.16.15-S1",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself",
         workarounds: [
            {
               lang: "en",
               value: "No workarounds known.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-officer@isc.org",
               DATE_PUBLIC: "2021-04-28T20:20:01.000Z",
               ID: "CVE-2021-25215",
               STATE: "PUBLIC",
               TITLE: "An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "BIND9",
                                 version: {
                                    version_data: [
                                       {
                                          version_name: "Open Source Branches 9.0 through 9.11",
                                          version_value: "9.0.0 through versions before 9.11.30",
                                       },
                                       {
                                          version_name: "Open Source Branches 9.12 through 9.16",
                                          version_value: "9.12.0 through versions before 9.16.14",
                                       },
                                       {
                                          version_name: "Supported Preview Branches 9.9-S through 9.11-S",
                                          version_value: "9.9.3-S1 through versions before 9.11.30-S1",
                                       },
                                       {
                                          version_name: "Supported Preview Branch 9.16-S",
                                          version_value: "9.16.8-S1 through versions before 9.16.14-S1",
                                       },
                                       {
                                          version_name: "Development Branch 9.17",
                                          version_value: "9.17.0 through versiosn before 9.17.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ISC",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "ISC would like to thank Siva Kakarla for bringing this vulnerability to our attention.",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.",
                  },
               ],
            },
            exploit: [
               {
                  lang: "en",
                  value: "We are not aware of any active exploits.",
               },
            ],
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "DNAME records, described in RFC 6672, provide a way to redirect a subtree of the domain name tree in the DNS. A flaw in the way named processes these records may trigger an attempt to add the same RRset to the ANSWER section more than once. This causes an assertion check in BIND to fail.  DNAME records are processed by both authoritative and recursive servers. For authoritative servers, the DNAME record triggering the flaw can be retrieved from a zone database. For servers performing recursion, such a record is processed in the course of a query sent to an authoritative server.  Affects BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://kb.isc.org/v1/docs/cve-2021-25215",
                     refsource: "CONFIRM",
                     url: "https://kb.isc.org/v1/docs/cve-2021-25215",
                  },
                  {
                     name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
                  },
                  {
                     name: "DSA-4909",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4909",
                  },
                  {
                     name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
                  },
                  {
                     name: "FEDORA-2021-ace61cbee1",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/",
                  },
                  {
                     name: "FEDORA-2021-47f23870ec",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210521-0006/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
                  },
                  {
                     name: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                     refsource: "CONFIRM",
                     url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "Upgrade to the patched release most closely related to your current version of BIND:\n\n    BIND 9.11.31\n    BIND 9.16.15\n    BIND 9.17.12\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9.11.31-S1\n    BIND 9.16.15-S1",
               },
            ],
            source: {
               discovery: "EXTERNAL",
            },
            work_around: [
               {
                  lang: "en",
                  value: "No workarounds known.",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2021-25215",
      datePublished: "2021-04-29T00:55:16.726513Z",
      dateReserved: "2021-01-15T00:00:00",
      dateUpdated: "2024-09-16T22:02:24.791Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.090Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/v1/docs/cve-2021-25215",
               },
               {
                  name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
               },
               {
                  name: "DSA-4909",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4909",
               },
               {
                  name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-21-657/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branches 9.5 though 9.11 9.5.0 through versions before 9.11.31",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branches 9.12 though 9.16 9.12.0 through versions before 9.16.14",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.11-S 9.11.3-S1 through versions before 9.11.31-S1",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1",
                  },
                  {
                     status: "affected",
                     version: "Development Branch 9.17 9.17.0 through versions before 9.17.2",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank an anonymous party, working in conjunction with Trend Micro Zero Day Initiative, for reporting this issue to us.",
            },
         ],
         datePublic: "2021-04-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between parties on a network.  SPNEGO is a negotiation mechanism used by GSSAPI, the application protocol interface for GSS-TSIG.  The SPNEGO implementation used by BIND has been found to be vulnerable to a buffer overflow attack.  Affects BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-08T14:07:31",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kb.isc.org/v1/docs/cve-2021-25215",
            },
            {
               name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
            },
            {
               name: "DSA-4909",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4909",
            },
            {
               name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-21-657/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND:\n\n    BIND 9.11.31\n    BIND 9.16.15\n    BIND 9.17.12\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9.11.31-S1\n    BIND 9.16.15-S1",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack",
         workarounds: [
            {
               lang: "en",
               value: "This vulnerability only affects servers configured to use GSS-TSIG, most often to sign dynamic updates. If another mechanism can be used to authenticate updates, the vulnerability can be avoided by choosing not to enable the use of GSS-TSIG features.\n\nPrior to the April 2021 BIND releases, on some platforms it was possible to build a working BIND installation that was not vulnerable to CVE-2021-25216 by providing the --disable-isc-spnego command-line argument when running the ./configure script in the top level of the BIND source directory, before compiling and linking named.\n\nAfter the April 2021 BIND releases, all supported branches have removed isc-spnego support. This corrects CVE-2021-25216, but requires that the system have other libraries and header files to support GSS-TSIG functionality, unless such functionality is completely disabled at build time by providing the --without-gssapi argument to the ./configurescript when selecting build options.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-officer@isc.org",
               DATE_PUBLIC: "2021-04-28T20:20:10.000Z",
               ID: "CVE-2021-25216",
               STATE: "PUBLIC",
               TITLE: "A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "BIND9",
                                 version: {
                                    version_data: [
                                       {
                                          version_name: "Open Source Branches 9.5 though 9.11",
                                          version_value: "9.5.0 through versions before 9.11.31",
                                       },
                                       {
                                          version_name: "Open Source Branches 9.12 though 9.16",
                                          version_value: "9.12.0 through versions before 9.16.14",
                                       },
                                       {
                                          version_name: "Supported Preview Branch 9.11-S",
                                          version_value: "9.11.3-S1 through versions before 9.11.31-S1",
                                       },
                                       {
                                          version_name: "Supported Preview Branch 9.16-S",
                                          version_value: "9.16.8-S1 through versions before 9.16.14-S1",
                                       },
                                       {
                                          version_name: "Development Branch 9.17",
                                          version_value: "9.17.0 through versions before 9.17.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ISC",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "ISC would like to thank an anonymous party, working in conjunction with Trend Micro Zero Day Initiative, for reporting this issue to us.",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security.",
                  },
               ],
            },
            exploit: [
               {
                  lang: "en",
                  value: "We are not aware of any active exploits.",
               },
            ],
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between parties on a network.  SPNEGO is a negotiation mechanism used by GSSAPI, the application protocol interface for GSS-TSIG.  The SPNEGO implementation used by BIND has been found to be vulnerable to a buffer overflow attack.  Affects BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://kb.isc.org/v1/docs/cve-2021-25215",
                     refsource: "CONFIRM",
                     url: "https://kb.isc.org/v1/docs/cve-2021-25215",
                  },
                  {
                     name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
                  },
                  {
                     name: "DSA-4909",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4909",
                  },
                  {
                     name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210521-0006/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-21-657/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-21-657/",
                  },
                  {
                     name: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                     refsource: "CONFIRM",
                     url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "Upgrade to the patched release most closely related to your current version of BIND:\n\n    BIND 9.11.31\n    BIND 9.16.15\n    BIND 9.17.12\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9.11.31-S1\n    BIND 9.16.15-S1",
               },
            ],
            source: {
               discovery: "EXTERNAL",
            },
            work_around: [
               {
                  lang: "en",
                  value: "This vulnerability only affects servers configured to use GSS-TSIG, most often to sign dynamic updates. If another mechanism can be used to authenticate updates, the vulnerability can be avoided by choosing not to enable the use of GSS-TSIG features.\n\nPrior to the April 2021 BIND releases, on some platforms it was possible to build a working BIND installation that was not vulnerable to CVE-2021-25216 by providing the --disable-isc-spnego command-line argument when running the ./configure script in the top level of the BIND source directory, before compiling and linking named.\n\nAfter the April 2021 BIND releases, all supported branches have removed isc-spnego support. This corrects CVE-2021-25216, but requires that the system have other libraries and header files to support GSS-TSIG functionality, unless such functionality is completely disabled at build time by providing the --without-gssapi argument to the ./configurescript when selecting build options.",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2021-25216",
      datePublished: "2021-04-29T00:55:17.362447Z",
      dateReserved: "2021-01-15T00:00:00",
      dateUpdated: "2024-09-16T22:25:23.581Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T19:56:11.064Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/v1/docs/cve-2021-25214",
               },
               {
                  name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
               },
               {
                  name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
               },
               {
                  name: "DSA-4909",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4909",
               },
               {
                  name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
               },
               {
                  name: "FEDORA-2021-ace61cbee1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/",
               },
               {
                  name: "FEDORA-2021-47f23870ec",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branch 9.8 9.8.5 through 9.8.8",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branches 9.9 through 9.11 9.9.3 through versions before 9.11.30",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1",
                  },
                  {
                     status: "affected",
                     version: "Development Branch 9.17 9.17.0 through versiosn before 9.17.12",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Greg Kuechle of SaskTel for bringing this vulnerability to our attention.",
            },
         ],
         datePublic: "2021-04-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the next SOA refresh query for that zone is made.  Affects BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-08T14:07:48",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kb.isc.org/v1/docs/cve-2021-25214",
            },
            {
               name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
            },
            {
               name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
            },
            {
               name: "DSA-4909",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4909",
            },
            {
               name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
            },
            {
               name: "FEDORA-2021-ace61cbee1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/",
            },
            {
               name: "FEDORA-2021-47f23870ec",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND:\n\n    BIND 9.11.31\n    BIND 9.16.15\n    BIND 9.17.12\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9.11.31-S1\n    BIND 9.16.15-S1",
            },
         ],
         source: {
            discovery: "USER",
         },
         title: "A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly",
         workarounds: [
            {
               lang: "en",
               value: "Disabling incremental zone transfers (IXFR) by setting request-ixfr no; in the desired configuration block (options, zone, or server) prevents the failing assertion from being evaluated.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-officer@isc.org",
               DATE_PUBLIC: "2021-04-28T20:19:47.000Z",
               ID: "CVE-2021-25214",
               STATE: "PUBLIC",
               TITLE: "A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "BIND9",
                                 version: {
                                    version_data: [
                                       {
                                          version_name: "Open Source Branch 9.8",
                                          version_value: "9.8.5 through 9.8.8",
                                       },
                                       {
                                          version_name: "Open Source Branches 9.9 through 9.11",
                                          version_value: "9.9.3 through versions before 9.11.30",
                                       },
                                       {
                                          version_name: "Open Source Branches 9.12 through 9.16",
                                          version_value: "9.12.0 through versions before 9.16.14",
                                       },
                                       {
                                          version_name: "Supported Preview Branches 9.9-S through 9.11-S",
                                          version_value: "9.9.3-S1 through versions before 9.11.30-S1",
                                       },
                                       {
                                          version_name: "Supported Preview Branch 9.16-S",
                                          version_value: "9.16.8-S1 through versions before 9.16.14-S1",
                                       },
                                       {
                                          version_name: "Development Branch 9.17",
                                          version_value: "9.17.0 through versiosn before 9.17.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ISC",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "ISC would like to thank Greg Kuechle of SaskTel for bringing this vulnerability to our attention.",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.",
                  },
               ],
            },
            exploit: [
               {
                  lang: "en",
                  value: "We are not aware of any active exploits.",
               },
            ],
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the next SOA refresh query for that zone is made.  Affects BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://kb.isc.org/v1/docs/cve-2021-25214",
                     refsource: "CONFIRM",
                     url: "https://kb.isc.org/v1/docs/cve-2021-25214",
                  },
                  {
                     name: "[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/1",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/2",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/3",
                  },
                  {
                     name: "[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/04/29/4",
                  },
                  {
                     name: "DSA-4909",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4909",
                  },
                  {
                     name: "[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html",
                  },
                  {
                     name: "FEDORA-2021-ace61cbee1",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/",
                  },
                  {
                     name: "FEDORA-2021-47f23870ec",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210521-0006/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210521-0006/",
                  },
                  {
                     name: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                     refsource: "CONFIRM",
                     url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "Upgrade to the patched release most closely related to your current version of BIND:\n\n    BIND 9.11.31\n    BIND 9.16.15\n    BIND 9.17.12\n\nBIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.\n\n    BIND 9.11.31-S1\n    BIND 9.16.15-S1",
               },
            ],
            source: {
               discovery: "USER",
            },
            work_around: [
               {
                  lang: "en",
                  value: "Disabling incremental zone transfers (IXFR) by setting request-ixfr no; in the desired configuration block (options, zone, or server) prevents the failing assertion from being evaluated.",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2021-25214",
      datePublished: "2021-04-29T00:55:16.042608Z",
      dateReserved: "2021-01-15T00:00:00",
      dateUpdated: "2024-09-17T00:37:21.136Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}