CVE-2021-25214: A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.
Other sources
ISC BIND is vulnerable to a denial of service, caused by a broken inbound incremental zone update (IXFR). By sending a specially crafted IXFR, an attacker could exploit this vulnerability to trigger a failed assertion check and terminate the named process.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-25214?
CVE-2021-25214 is a vulnerability in ISC BIND that can lead to a denial of service caused by a broken inbound incremental zone update.
Which versions of BIND are affected by CVE-2021-25214?
BIND versions 9.8.5 through 9.8.8, 9.9.3 through 9.11.29, 9.12.0 through 9.16.13, and 9.9.3-S1 through 9.11.29-S1 and 9.16.8-S1 through 9.16.13-S1 of BIND 9 Supported Preview Edition are affected, as well as release versions 9.17.0 through 9.17.11 of the BIND 9.17 development branch.
What is the severity of CVE-2021-25214?
CVE-2021-25214 has a severity rating of 6.5 (Medium).
How can I fix CVE-2021-25214?
To fix CVE-2021-25214, you should update to the appropriate patched versions of BIND, such as 9.11.5.P4+dfsg-5.1+deb10u7 or 9.16.15-1.
Where can I find more information about CVE-2021-25214?
You can find more information about CVE-2021-25214 in the references provided: http://www.openwall.com/lists/oss-security/2021/04/29/1, http://www.openwall.com/lists/oss-security/2021/04/29/2, http://www.openwall.com/lists/oss-security/2021/04/29/3.