Riskcovery

CVE-2021-25214

A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

State
Published
Severity
6.5 Medium
Published
Apr 29, 2021
Updated
Sep 17, 2024
Reserved
Jan 15, 2021

Read the record on cve.org

Description

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hisc

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
BIND9ISC
  • Open Source Branch 9.8 9.8.5 through 9.8.8Affected
  • Open Source Branches 9.9 through 9.11 9.9.3 through versions before 9.11.30Affected
  • Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14Affected
  • Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1Affected
  • Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1Affected
  • Development Branch 9.17 9.17.0 through versiosn before 9.17.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.