CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Overview
ISC BIND versions 9.1.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2 contain a reachable assertion flaw in the handling of TKEY DNS queries. A remote attacker with no authentication can send a single crafted packet to crash the named daemon, taking down DNS resolution for every client the server serves. Both recursive and authoritative configurations are affected, and no ACL or configuration option prevents exploitation because the vulnerable code path executes before those checks are evaluated.
Vulnerability details
The flaw is a reachable assertion (CWE-617) triggered by improper data handling (CWE-19) in BIND's TKEY query processing. When named processes a TKEY query, it searches for the associated TKEY record first in the packet's additional-records section, then in the answer section. A pointer parameter initialized to NULL may be set to a non-NULL value during the failed first lookup. When that non-NULL value is passed into the second lookup, an internal REQUIRE assertion fails and named exits immediately. Because this logic runs before any ACL or access-control evaluation, no configuration option can block the trigger path.
An attacker sends a single specially crafted DNS packet containing a TKEY record type in the question section and a non-TKEY additional record sharing the same name. No authentication, prior session, or privileged network position is required. The packet can be delivered over the network to any reachable BIND instance. The outcome is a complete denial of service: named crashes, and all DNS resolution served by that instance stops until the process is restarted. The advisory confirms no data corruption or code execution is possible; the impact is limited to availability.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor named process logs and system logs for REQUIRE assertion failure messages followed by an unexpected daemon exit. A named process that terminates without a scheduled restart or SIGTERM is a strong indicator of exploitation.
- Watch for inbound DNS queries to port 53 where the question section carries record type 249 (TKEY) and the additional section contains a record of a different type with the same owner name. This specific structure is not produced by normal DNS clients.
Remediation
Additional hardening
- Upgrade BIND to version 9.9.7-P2 (for the 9.9.x line) or 9.10.2-P3 (for the 9.10.x line). The ISC advisory confirms these as the fixed releases. See References for the vendor advisory.
- Restrict DNS port 53 access at the network perimeter to known, authorized sources where operationally feasible. Because the flaw fires before ACL evaluation inside named, external firewall or router ACLs are the only pre-patch layer that can block the crafted packet.
- Deploy rate-limiting on inbound DNS queries at the network edge to reduce the volume of exploit attempts and slow automated scanning, even though a single packet is sufficient to trigger the crash.
- If named cannot be patched immediately, run it under a process supervisor configured to restart automatically on crash, reducing downtime while a maintenance window is arranged. This does not prevent exploitation but limits service disruption.
Key dates
References
- https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272
- https://access.redhat.com/errata/RHSA-2015:1513.html
- https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2015-5477
- http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html
- https://www.exploit-db.com/exploits/37721/
Frequently asked questions
Does CVE-2015-5477 affect my FedRAMP authorization?
If ISC BIND runs inside your authorization boundary, yes. CVE-2015-5477 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of October 11, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV inside the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your path forward is either to remediate now or formally document the mitigation and the delay.
How does Knox help me handle CVE-2015-5477?
Knox does not patch your software. Remediating ISC BIND is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to help you document the fix for your next assessment. The remediation work is yours to carry out; maintaining a compliant posture while you carry it out is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including cases like CVE-2015-5477. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, which gives you a narrower window between disclosure and response.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2015-5477's remediation deadline of October 11, 2026 has passed. What happens now?
If ISC BIND remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing out the finding and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
